ProcessQuery.svc Access denied for Window Users

Question

ProcessQuery.svc working for Anonymous & Trusted Identity Provider extended sites, but the Default Windows (Kerberos) web application users fail Client OM call to ProcessQuery.svc (Access Denied).

The first question is what account do Anonymous users run as (since it is working)?

Why do users signing in through Trusted Identity Provider (Azure ACS) work, are these users using the same account as Anonymous users?

How is get Intergrated users working?

More SharePoint crazy.

Answer 1

Simple solution:

Create a new permission level and select 'Use Remote Interfaces'

Grant Permissions: for 'Domain Users' select Grant users permission directly & check permission level added above.

Now Domain user can use ProcessQuery.svc; interesting Anonymous & Trusted Identity Providers have more permissions initially.