title: Web API with authorization keeps prompting for sign in
body: <p>I am trying to make an ASP.NET Core Web API, which uses Windows AD groups for sign in. Based on <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-3.1&amp;tabs=visual-studio#kestrel" rel="nofollow noreferrer">the documentation</a>, I have configured the authorization and authentication in the <code>Startup.ConfigureServices()</code> method:</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddAuthorization(options =&gt;
      {
          options.AddPolicy(&quot;Reader&quot;, policy =&gt; policy.RequireRole(@&quot;&lt;DOMAIN&gt;\&lt;AD_ROLE_NAME&gt;&quot;));
      });
  
      services
          .AddAuthentication(NegotiateDefaults.AuthenticationScheme)
          .AddNegotiate();
  
      services.AddControllers();
  }
  </code></pre>
  <p>I have then added the <code>[Authorize]</code> attribute to my controller, to ensure than only users who are a member of the AD group, can get access to the end point:</p>
  <pre><code>[Authorize(Policy = &quot;Reader&quot;)]
  [HttpGet]
  public IEnumerable&lt;WeatherForecast&gt; Get()
  {
      var rng = new Random();
      return Enumerable.Range(1, 5).Select(index =&gt; new WeatherForecast
      {
          Date = DateTime.Now.AddDays(index),
          TemperatureC = rng.Next(-20, 55),
          Summary = Summaries[rng.Next(Summaries.Length)]
      })
      .ToArray();
  }
  </code></pre>
  <p>If I run the API (from Visual Studio) with <a href="https://en.wikipedia.org/wiki/Internet_Information_Services" rel="nofollow noreferrer">IIS</a>, it seems to work fine. However, if I change it the execution method which has the same name as the API (I think it's <a href="https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-3.1" rel="nofollow noreferrer">Kestrel</a>?), then it keeps prompting me for sign in.</p>
  <p>How do I get it to work with Kestrel (or whatever that other option is)?</p>
  <p><a href="https://i.stack.imgur.com/DW12d.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DW12d.png" alt="IIS works, Kestrel does not" /></a></p>
  <p><a href="https://i.stack.imgur.com/j414O.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/j414O.png" alt="The sign in box keeps popping up" /></a></p>