The other day I was messing around with the MOSS search web service (search.asmx) when I ran into a bit of a show stopper. Every time I tried to execute a method on the web service on a particular site I got the following error:
Attempted to perform an unauthorized operation.
Now it turns out that if anonymous access is enabled, the search service will return this error whether you are accessing it anonymously or not. In fact even if you haven’t enabled anonymous access at the site level it will still not work. In this case it is still enabled at the web application/zone level and hence in IIS. I believe this is only an issue with the search web service, but I can’t confirm that.
So I have come up with three different solutions to address the issue, and the right solution will depend on your scenario:
- Disable anonymous access on the search.asmx file in IIS. Doing this means that anonymous access is enabled for everything except the one web service that doesn’t like it. The bad thing about this approach is that it requires a manual edit in IIS putting SharePoint and IIS out of sync. This may mean the setting gets overwritten later, or it may have strange affects if you later disable anonymous access for the whole site.
- Use the URL of another non-anonymous enabled SharePoint site (could even be central admin). This is a good quick fix if you are trying to put together a prototype or something, but not the best in a production environment. Reason being that the user account used for the search service access will need to authenticate on the other site.
- Extend the web application to provide a non-anonymous zoned IIS site – you may already have one. This is my recommended approach, but like many best practices it is the most complicated/time consuming/puts biggest load on server. See this article on TechNet if you are unsure how to go about that.
So why was I playing with the search web service anyway? Why not just use the object model? Or better yet why not use the OOTB search webparts? Basically I wanted more flexibility, I wanted to use the search components of MOSS as a remote service that doesn’t require SharePoint context. For example utilising search from a separate non-SharePoint web application. An even more interesting use might be to provide anonymously accessible people search.
There are also some great search web service controls available from the awesome SharePoint search community tool kit.