HttpClient on non-Windows does not support Windows authentication

[lextm]

The following code snippet works fine on Windows (.NET Framework), and can authenticate against an IIS web service configured with Windows authentication only. Status code is 200.

            using (var client = new HttpClient (
                new HttpClientHandler {
                    PreAuthenticate = true,
                    UseDefaultCredentials = false,
                    UseProxy = false,
                    Credentials = new NetworkCredential ("user", "pass", "domain")
                })) {
                client.BaseAddress = new Uri ("http://test.com");
                client.DefaultRequestHeaders.Accept.Clear ();
                client.DefaultRequestHeaders.Accept.Add (new MediaTypeWithQualityHeaderValue ("application/json"));

                HttpResponseMessage response = await client.GetAsync ("test/values");
                if (response.IsSuccessStatusCode) {
                    Console.WriteLine (await response.Content.ReadAsStringAsync ());
                } else {
                    Console.WriteLine (response.StatusCode);
                }
            }

However, when it runs in a .NET Core RC2 app on Mac, the response status code is always 401. By capturing packets via Wireshark, no user credentials are sent. (if disable Windows authentication and enable Basic authentication, then it works with 200 status code and user credentials in packets.)

So I think the cross platform Windows authentication support is not yet fully implemented. Is there a plan to address this?

[stephentoub]

If you mean NTLM, the support is there, but in RC2 you need to explicitly opt-in to using it, e.g. using a CredentialCache that includes the NetworkCredential added for "NTLM" rather than just the NetworkCredential. Post-RC2, you shouldn't need to do that.

If you mean Negotiate, some gss API implementations only consider Kerberos, while others fallback to NTLM if Kerberos can't be negotiated. HttpClient uses libcurl on Linux and OSX, and libcurl uses some gssapi implementation to provide that support, so depending on which yours is using, it may or may not support that fallback. Kerberos should work, but Kerberos on Linux and OSX requires special configuration in general (you can search the net for info on configuring your system).

[lextm]

@stephentoub Thanks for the hint of "explicitly opt-in". Didn't know this is an RC 2 limitation. Will do more experiments and close this issue.

[ericeil]

Closing this, since it's already fixed post-RC2. @lextm, feel free to reopen this issue if this doesn't work for you.