Passing credentials with IServerXMLHTTPRequest   

Hi,

Sorry for crossposting this here, but I don't seem to be getting any
response in microsoft.public.xml and I thought maybe one of the gurus
in here can help. In short, I would like to know how to enable
automatic logon when using ServerXMLHttp, so that default credentials
are passed from client to server, instead of having to specify
username/password.


I have an application written in C++ using IServerXMLHTTPRequest to
access items in the exchange store via WebDAV requests. I have been
explicitly entering the username/password in the call to
IServerXMLHTTPRequest.Open (...), but I would like to use windows
authentication instead, i.e. not pass any username/password in that
call and instead use the credentials of the user that is logged in.

When I remove username/password in the call however, I get status 401
returned from the server.

I tested WinHttp instead and I had the same problem, but I solved that
by setting WINHTTP_OPTION_AUTOLOGON_POLICY to
WINHTTP_AUTOLOGON_SECURITY_LEVEL_LOW which causes WinHttp to always
delegate default credentials to the server.

But how can I change this setting when using XMLHTTP? I read that
XMLHTTP uses WinHTTP, so it should be possible to connect in the same
way right?

The client and server are on the same domain, but that shouldn't
matter I think. I am quite certain that this problem is in my use of
XMLHTTP since I can get windows authentication working with WinHTTP
and also I can access the exchange store via a browser without having
to provide any credentials.

Relevant code:
_______________________________________________________

HRESULT hr;
CComPtr<IServerXMLHTTPRequest> serverXMLHTTP;

// Create an instance of ServerXMLHTTP Class
hr = serverXMLHTTP.CoCreateInstance(CLSID_ServerXMLHTTP40);
if( FAILED(hr))
        return;

// Initialize the Synchronous HTTP POST request
hr = serverXMLHTTP->open (_bstr_t(_T("SEARCH")), _bstr_t( "http://
server/exchange/uid" ), _variant_t(false) );
if( FAILED(hr))
        return;

strRequest = ....... // set up request to send to server, not really
interesting here

//Setup for transmission
TCHAR szDataLen[32] = {0};
int iDataLen = strRequest.length();     //Get total length of what we
are
sending
itoa(iDataLen, szDataLen, 10);

//Set required http headers
serverXMLHTTP->setRequestHeader(_bstr_t(_T("Content-Type")),
_bstr_t(_T("text/xml")));
serverXMLHTTP->setRequestHeader(_bstr_t(_T("Translate")),
_bstr_t(_T("f")));
serverXMLHTTP->setRequestHeader(_bstr_t(_T("Content-Length")),
_bstr_t( szDataLen ));

// Send the HTTP POST request, with XML document as POST data
hr = serverXMLHTTP->send( _variant_t( strRequest ) );
if( FAILED(hr))
        return;

// Get status code
long status;
serverXMLHTTP->get_status( &status );
_______________________________________________________

As I said, if I explicitly specify username/password, as below,
everything works...

hr = serverXMLHTTP->open (_bstr_t(_T("SEARCH")), _bstr_t( "http://
server/exchange/uid" ), _variant_t(false), _variant_t ( "username" ),
_variant_t ( "password" ) );

Thanks for any help.
 - Jellobiaffra

date: 15 Feb 2007 00:40:03 -0800   author:   Jellobiaffra