Authorization failed in Blazor server-side app

[romandres]

SDK: dotnet-sdk-3.0.100-preview8-013656-win-x64
IDE: Visual Studio 2019 16.3 Preview 2.0
OS: Windows 10 1903 (18362.1.amd64fre.19h1_release.190318-1202)

Using Windows Authentication, authorization in Blazor server-side app always results in NotAuthorized when using debug launch command 'Project' instead of 'IISExpress'.

Steps to reproduce using a new app:

1. Create a new Blazor App in Visual Studio (Server-side, Windows Authentication)
2. Debug the app using launch command 'IISExpress' -> The LoginDisplay component displays the Windows Username
3. Debug the app using launch command 'Project' -> The LoginDisplay component displays nothing. The log contains this message: [Microsoft.AspNetCore.Authorization.DefaultAuthorizationService] Authorization failed.

Before updating to .NET Core 3.0 preview8 I was using preview7 where this was not an issue.
I have an existing app which I migrated from preview7 to preview8. The MVC part of the app and the authorization works while the Blazor server-side part always results in NotAuthorized if I don't use IISExpress to debug.

[mkArtakMSFT]

Thanks for contacting us, @romandres.
@SteveSandersonMS don't we have a CTI scenario validating this daily?

[SteveSandersonMS]

@mkArtakMSFT No, we only have a CTI scenario covering the Identity auth case (not Windows auth).

In any case, as far as I'm aware, Windows Authentication is not expected to work by default when hosting directly on Kestrel, since Kestrel doesn't support it. I checked, and the default MVC site template with Windows authentication also doesn't work if you run it directly on Kestrel instead of IISExpress.

The fact that Kestrel doesn't support Windows Authentication directly is mentioned here, though I'm unsure where this fact is covered in official documentation.

It is possible to host ASP.NET Core on HTTP.sys directly and then enable Windows authentication via HTTP.sys, which should work the same with server-side Blazor. But setting it up is nontrivial as per docs.

@HaoK Do you agree with this diagnosis? Is there anything I've missed?

[pranavkm]

Closing this as by design.