Where does DefaultCredentials pull out "UserName" as a username for a web request?

Question

There's a WinForms desktop application which tries to connect to SSRS service. The Reporting Server is configured to accept both Active Directory credential logins and also a credential for specific user for reporting purposes. In the following code section we use a WinForms ReportViewer:

reportViewer.ServerReport.ReportServerUrl = new Uri(_dboardServices.ReportingServicesUrl);
reportViewer.ServerReport.ReportServerCredentials.NetworkCredentials = CredentialCache.DefaultCredentials;

This works fine on my fellow developer's machine, and for most of our clients. But some clients experience 401: System.Net.WebException: The request failed with HTTP status 401: Unauthorized, coming from the SoapHttpClient system. Interestingly I can reproduce this issue on my machine. Looking into the traffic with Fiddler, an NTLM authentication starts, and then "UserName" (literally!) sent as a username instead of my real username. Obviously that fails.

If I construct a credential with the right username, password and domain (reportViewer.ServerReport.ReportServerCredentials.NetworkCredentials = new NetworkCredential(goodUserName, goodPassword, domain);) my request succeeds. Just as if I navigate to the SSRS asmx link and type in my credentials. But CredentialCache.DefaultCredentials (which should default to my AD credentials) pulls out this "UserName" from somewhere. Where does the system gets that from? I searched our source code and the web with no luck so far.

Answer 1

It is likely an issue with stored credentials. See what credentials you have stored by running control keymgr.dll at the command line. See this article.