Trying to set HttpSysOptions.Authentication.Schemes to contain AuthenticationSchemes.Kerberos leads to mysterous failure

[jhudsoncedaron]

This issue is in the documentation, and probably should be addressed in the XML comment documentation.

When using UseHttpSys(), if you set HttpSysOptions.Authentication.Schemes to contain AuthenticationSchemes.Kerberos and the machine is not on a domain you get a mysterious error

fail: Microsoft.AspNetCore.Server.HttpSys.HttpSysListener[0] SetUrlGroupProperty Microsoft.AspNetCore.Server.HttpSys.HttpSysException (0x80004005): A specified authentication package is unknown fail: Microsoft.AspNetCore.Server.HttpSys.HttpSysListener[0] Start Microsoft.AspNetCore.Server.HttpSys.HttpSysException (0x80004005): A specified authentication package is unknown at Microsoft.AspNetCore.Server.HttpSys.UrlGroup.SetProperty(HTTP_SERVER_PROPERTY property, IntPtr info, UInt32 infosize, Boolean throwOnError) at Microsoft.AspNetCore.Server.HttpSys.AuthenticationManager.SetUrlGroupSecurity() at Microsoft.AspNetCore.Server.HttpSys.HttpSysOptions.Apply(UrlGroup urlGroup, RequestQueue requestQueue) at Microsoft.AspNetCore.Server.HttpSys.HttpSysListener.Start()

The problem is requesting Kerberos when not on a domain. To have a ghost of a chance requires reading the source code of UrlGroup.SetProperty to find the native method and then reading the documentation of the native method to determine what it's trying to do.

The apparent use of HttpSysOptions.Authentication.Schemes is to provide the list of acceptable authentication schemes. The actual meaning is try to initialize all of these and fail if any don't work.

Getting "X is unknown" from an enum argument is pretty hard to understand as it is. The documentation needs to call it out because of the bad error message.

[Rick-Anderson]

Thanks for the info.

[Rick-Anderson]

Thanks for contacting us. We don’t have the resources to invest in this area, so we are closing the issue. Should your request generate enough 👍 responses, we’ll reconsider.