HttpClient UseDefaultCredentials Get with kerberos auth server sends NTLM #51701
Description
Description
With netcoreapp3.1 the following code will send Kerberos to the web server. Switching the application to .net 5.0 causes NTLM to be sent. The web server is a IBM i Apache, with kerberos configured. The server does not have NTLM, so the code fails.
Configuration
Running .net 5.0 on a Windows 10 machine
Connecting to an IBM i Apache Web server with kerberos enabled
Regression?
This code works if you switch the project to build netcoreapp3.1 and it fails if you switch it to .net 5.0
Other information
Here is the code that fails
static async Task Main(string[] args)
{
var url = "https://myIBMi.myDomain.com/api.php?task=getUser";
var http = new System.Net.Http.HttpClient(new HttpClientHandler()
{
UseDefaultCredentials = true
});
var result = await http.GetAsync(url);
string responseText = await result.Content.ReadAsStringAsync();
Console.WriteLine(responseText);
}
}netcoreapp3.1 calling the code
- Using fiddler I've captured the raw request and response
- Initial Request
GET https://myIBMi.myDomain.com/api.php?task=getUser
HTTP/1.1
Host: myIBMi.myDomain.com:451
- Initial Response
HTTP/1.1 401 Unauthorized
Date: Thu, 22 Apr 2021 17:58:09 GMT
Server: Apache
WWW-Authenticate: Negotiate
Content-Length: 205
Connection: close
Content-Type: text/html; charset=UTF-8
Proxy-Support: Session-Based-Authentication
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>401 Authorization Required</TITLE>
</HEAD><BODY>
<H1>Authorization Required</H1>
Unauthorized - authentication failed.
</body></html>
- Request to the unauthorized response
- I abreviated the kerberos ticket information below
GET https://myIBMi.myDomain.com/api.php?task=getUser
HTTP/1.1
Host: myIBMi.myDomain.com:451
Authorization: Negotiate YIII8gYGKwYBB....
- Then the response is a success. Not sure it's important to show that part.
change the project to .net 5.0
- Initial Request
GET https://myIBMi.myDomain.com/api.php?task=getUser
HTTP/1.1
Host: myIBMi.myDomain.com:451
- Initial Response
HTTP/1.1 401 Unauthorized
Date: Thu, 22 Apr 2021 18:10:57 GMT
Server: Apache
WWW-Authenticate: Negotiate
Content-Length: 205
Connection: close
Content-Type: text/html; charset=UTF-8
Proxy-Support: Session-Based-Authentication
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>401 Authorization Required</TITLE>
</HEAD><BODY>
<H1>Authorization Required</H1>
Unauthorized - authentication failed.
</body></html>
- Request to respond to initial response
- I have edited it to not show the full ntlm value
GET https://myIBMi.myDomain.com/api.php?task=getUser
HTTP/1.1
Host: myIBMi.myDomain.com:451
Authorization: Negotiate TlRMTVNTUA....