I have two web services, of old school, asmx. Both is in the same sub folder, which have anonymous authentication, in a MVC web application that have windows authentication.

When I browse one of them I get expected result, I can Invoke the service, but when I browse the other I get "HTTP Error 401.2 - Unauthorized You are not authorized to view this page due to invalid authentication headers.".

I then rename the second one and everything works fine. Even if I remove the second asmx file I get Unauthorized, instead of "Resource not found".

I have searched the registry and the file system for references to the file name, but find nothing. I deleted ASP.NET Temporary Files, but that did not help.

Any trouble shooting suggestions?

  • what are the names of the services? – kafka Mar 5 '15 at 13:41
  • We can call them 1.asmx and 2.asmx. I do not think the name conflicts with any reserved names in IIS or Windows, since I do not use english names. – Martin Bring Mar 5 '15 at 14:15

This was not easy to find, but in inetpub\temp\appPools\ there was a folder named as the application pool. In that folder there is "copy" of parts of the IIS config.

At some point we must have accidentally marked the actual asmx file, instead of the folder when we changed autentication. So it contained a special configuration section for just the file. Like:

<location path="Web/Services/ServiceName.asmx">
                <anonymousAuthentication enabled="false" />

When we removed that section it worked again :)


After much work, I found the same thing... I think that the common theme here is that the folder in question is called "Services" <location path="Default Web Site/MyDirectory/Services">

There was a spurious entry in the app pool config file where <anonymousAuthentication enabled="false" />

My solution, set anonymousAuthentication = "True"

I wonder whether this is a little bug in IIS where this part of the config is ignored for some reason.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.