title: How to enable an dotnet 6 client app in a linux container to authenticate with user/password against a kestrel server with kerberos
body: <p>I'm developing a Service in ASP.Net-Core (.net6) that connects to a BusinessCentral OData API.
  The Server has SSL/Kerberos enabled and I have a user and password to authenticate with.
  I use the AddHttpClient-IServiceCollectionExtension in my Program.cs like:</p>
  <pre><code>services.AddHttpClient([name], httpClient =&gt;
  {
    httpClient.BaseAddress = new Uri(config[BaseUrl]);
  }).ConfigurePrimaryHttpMessageHandler(() =&gt;
    new HttpClientHandler()
    {
      Credentials = new NetworkCredential(
        config[Username],
        config[Password],
        config[Domain])
    }
  );
  </code></pre>
  <p>...and inject the IHttpClientFactory to my client-class:</p>
  <pre><code>MyODataClient(IHttpClientFactory factory)
  {
    _client = factory!.CreateClient([name]);
  }
  
  public HttpResponseMessage GetEntity(Entity src)
  {
    var path = $&quot;{src.Type}('{src.SysId}')?&quot;;
    var request = new HttpRequestMessage(HttpMethod.Get, path);
    var response = _client.SendAsync(request);
    return response;
  }
  </code></pre>
  <p>So far so good. Everything ist fine and works (with swagger)!
  BUT...
  When I start this service within a linux Docker container, I get the error:</p>
  <p><strong>GSSAPI operation failed with error - Unspecified GSS failure.  Minor code may provide more information (Cannot find KDC for realm &quot;[domain]&quot;).</strong></p>
  <hr />
  <p>Then I tried:</p>
  <pre><code>builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();
  builder.Services.AddAuthorization(options =&gt;
  {
    options.FallbackPolicy = options.DefaultPolicy;
  });
  </code></pre>
  <p>Now Swagger ask me for username and password. It doesn't work but I think this is why I don't passthrough the headers from swagger to BC19... with HeaderPropagation or so (??).
  Btw. I need to use a static user. No interaction...</p>
  <hr />
  <p>I also read and tried keytab-stuff... But everything I read was &gt;2 years old. Does anybody know, how to deal with it in .net6? It seems to be quite easy but I don't find the two lines of code, that I need to connect the httpClientHandler (credentials) with the AuthenticationBuilder (negotiate)</p>
  <p>Maybe this log helps:</p>
  <pre><code>Authorization failed. These requirements were not met:
  DenyAnonymousAuthorizationRequirement: Requires an authenticated user.
  [17:20:26 INF] AuthenticationScheme: Negotiate was challenged.
  [17:20:26 INF] Request finished HTTP/1.1 GET https://localhost:49179/Entity?[...]. - - - 401 0 - 28.0138ms
  </code></pre>
  <p>best regards</p>
  <p>Oli</p>