Kestrel Windows Auth is not prompting UN/PW challenge on macOS, when server runs on windows AD.

[sanderaiaots]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I'm struggling to get windows auth working on Kestler.
It kinda works, but only when clients are windows Chrome or IE browsers. When client in MacOS UN/PW challenge is not prompted.

Expected Behavior

Expected behaviour is that macOS Chrome / Safari would also prompt for username password.

Steps To Reproduce

Setup keslter server running on windows and enable windows auth like:
Main:
builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate(); //for my case I want Auth to be executed on specific path of URL app.UseWhen(context => context.Request.Path.StartsWithSegments("/Auth"), specificPathApp => { specificPathApp.UseAuthentication(); // Apply authentication only for this path specificPathApp.UseAuthorization(); });

AuthController:
public class AuthController : Controller { [HttpGet] [Authorize] public ActionResult Index(string? redirect = null) { WindowsIdentity? winIdent = User.Identity as WindowsIdentity; return new ContentResult { Content = "Auth ok, winidentity: name=" + (winIdent?.Name ?? "user not found"), ContentType = "text/plain" }; } }

Exceptions (if any)

No response

.NET Version

8.0.101

Anything else?

No response

[Tratcher]

That seems like a client limitation, I don't know that there's anything the server can/should do differently here. Does it work with any other servers?

[sanderaiaots]

Might as well be issue how browsers have implemented Negotiate authentication on MacOS, but on windows I get prompted UN/PW when I access site outside my domain, in Mac I just get 401.
So far same behaviour in Mac with: Chrome, Safari, Firefox.
It works with IIS 10 server, but its also offer NTLM auth, that might work on MacOS.