I am using the sample posted by Morten and I am recieving the following error on the legend.ashx page when I attempt to point to a service endpoint that has security enabled: Unable to generate legends: The HTTP request was forbidden with client authentication scheme 'Anonymous'.
Other services on the server are secured but the service I am attempting to point to is not. Having said that, I think that when you enable security that all services retain some level of security--the service in question is currently granting permissions to "Everyone". Map Services from 9.3.1 versions of AGS render fine.
