Windows Authentication Error using Kestrel for .NET Core Web API, when accessed remotely.

[candreouTrade]

I have created a simple Web Service using Web Api with .NET core.

When I run the service on my development machine and try to access it from the chrome browser on my development machine, the service behaves as expected. When I ask another developer to try to access my service from the chrome browser on their machine, I get the below error in the service logs:

Any idea how i can allow remote machines to access my service?
I am using windows authentication for the service.

Exception thrown: 'System.InvalidOperationException' in Microsoft.AspNetCore.Authentication.Negotiate.dll
Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler: Error: An exception occurred while processing the authentication request.

System.InvalidOperationException: An anonymous request was received in between authentication handshake requests.
at Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler.HandleRequestAsync()
Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler: 2020-03-24 14:26:00,864 [43] ERROR Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler - An exception occurred while processing the authentication request.
System.InvalidOperationException: An anonymous request was received in between authentication handshake requests.
at Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler.HandleRequestAsync()
Exception thrown: 'System.InvalidOperationException' in System.Private.CoreLib.dll
Exception thrown: 'System.InvalidOperationException' in System.Private.CoreLib.dll
Exception thrown: 'System.InvalidOperationException' in System.Private.CoreLib.dll
Microsoft.AspNetCore.Server.Kestrel: Error: Connection id "0HLUFVOPNUQDT", Request id "0HLUFVOPNUQDT:0000002A": An unhandled exception was thrown by the application.

System.InvalidOperationException: An anonymous request was received in between authentication handshake requests.
at Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler.HandleRequestAsync()
at Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler.HandleRequestAsync()
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication1 application) Microsoft.AspNetCore.Server.Kestrel: 2020-03-24 14:26:00,929 [43] ERROR Microsoft.AspNetCore.Server.Kestrel - Connection id "0HLUFVOPNUQDT", Request id "0HLUFVOPNUQDT:0000002A": An unhandled exception was thrown by the application. System.InvalidOperationException: An anonymous request was received in between authentication handshake requests. at Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler.HandleRequestAsync() at Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler.HandleRequestAsync() at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication1 application)

[blowdart]

Are they on your internet network? Are they using an internal name on the network?

[Tratcher]

It's not supposed to do that...

Negotiate/NTLM/Kerberos don't allow any other requests on a connection while the authentication is in progress. If the auth gets interrupted then it's supposed to close the connection. It sounds like their browser sent a request it wasn't supposed to.

Can you turn the server logs up to Trace level to get the full details? Turning on Kestrel connection logging can also capture more:
https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-3.1#connection-logging

[candreouTrade]

Are they on your internet network? Are they using an internal name on the network?

This is an intranet application. I am using the name of the remote machine hosting the web service, in the browser URL. eg http://MachineHostingWebApiService:50011/GetData

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment. If it is closed, feel free to comment when you are able to provide the additional information and we will re-investigate.

See our Issue Management Policies for more information.

[Yustos]

I see this problem too.
Tried to prepare example in branch: https://github.com/Yustos/AspNetCoreSubdomain/commits/auth_trouble
Reproduce steps:

• Compile AspNetCoreSubdomain.Samples.csproj
• Place bin folder to remote server (example.com)
• Run on remote server AspNetCoreSubdomain.Samples.exe in console
• On local computer open http://example.com:5000 in chrome browser

You can see error 404 in browser and this topic error in log.
Or you can try postman get query with NTLM auth - there will be 401 error and same error in server log.

In the fiddler all three negotiate requests exists, bug without success:
№ Result Protocol Host URL Body Caching Content-Type Process Comments Custom
7 401 HTTP example.com:5000 / 0 postman:119596
8 401 HTTP example.com:5000 / 0 postman:119596
9 401 HTTP example.com:5000 / 0 postman:119596

There is connection log, as you ask:
auth_log.txt

Remark: i replaced server name to example.com and username from domain to Yustos in attached log.

At last, i was tried HTTP.SYS auth (see commented code in example branch Yustos/AspNetCoreSubdomain@d39dd1f) - it work fine.

I followed auth example prepare by this guide on windows (client and server): https://docs.microsoft.com/ru-ru/aspnet/core/security/authentication/windowsauth?view=aspnetcore-3.1&tabs=visual-studio#kestrel
Except setspn command: https://docs.microsoft.com/ru-ru/aspnet/core/security/authentication/windowsauth?view=aspnetcore-3.1&tabs=visual-studio#windows-environment-configuration