NTLM authentication HttpClient in Core 3.1

[Anhbta]

I'm trying to use HttpClient to call rest api that requires NTLM authentication.
Below code works fine in .net core 2.2 but keep getting 401 with .net core 3.1

static void Main(string[] args)
{
    var client = Create("base-url");
    var response = client.GetAsync("api/v1.0/token").Result;

    HttpClient Create(string urlRoot)
    {
        var uri = new Uri(urlRoot);
        var handler = new HttpClientHandler() { PreAuthenticate = true, UseDefaultCredentials = true};
        var httpClient = new HttpClient(handler) { BaseAddress = uri  };
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

        return httpClient;
    }
}

This is running in windows 10.

Tagging subscribers to this area: @dotnet/ncl
Notify danmosemsft if you want to be subscribed.

[davidsh]

What kind of server is being used? Is this using an ASP.NET Core server that uses NTLM authentication? NTLM authentication is not supported by ASP.NET Core kestrel server.

Can you describe the server more specifically?

[Anhbta]

I don't handle the server side but it seems to be kestrel from the response:
{Transfer-Encoding: chunked
Server: Kestrel
Persistent-Auth: true
X-Powered-By: ASP.NET
Date: Thu, 23 Apr 2020 21:53:49 GMT
}

But why it works fine in .net core 2.1 ?

[davidsh]

But why it works fine in .net core 2.1 ?

I don't think Kestrel supported Windows authentication in .NET Core 2.1.

@Tratcher Can you confirm?

This is the current documentation for using Kestrel with Windows authentication:
https://docs.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-3.1&tabs=visual-studio

@Anhbta As I mentioned NTLM authentication is not supported in Kestrel. If it turns out that you aren't using HttpClient against Kestrel but rather a different server, please include more information about that.

[Tratcher]

I don't think Kestrel supported Windows authentication in .NET Core 2.1.

Correct, you must have been using IIS or HttpSys in 2.x.

Note those response headers indicate you're using IIS-out-of-proc+Kestrel, in which case the NTLM is handled by IIS.

[Tratcher]

@davidsh isn't 2.2 when you switch to SocketsHttpHandler by default?

[davidsh]

@davidsh David Shulman FTE isn't 2.2 when you switch to SocketsHttpHandler by default?

SocketsHttpHandler is used by default since .NET Core 2.1.

@Anhbta

As a workaround can you try to disable SocketsHttpHandler by adding this to your code (before any network API calls)?

AppContext.SetSwitch("System.Net.Http.UseSocketsHttpHandler", false);

Let us know if it works better. Thanks.

[Anhbta]

I have the same issue with another api that requires Kerberos authentication. The UseDefaultCredentials works just fine in .net core 2.1 but always get 401 when switching to .net core 3.1.

AppContext.SetSwitch("System.Net.Http.UseSocketsHttpHandler", false); this works for now.