title: Authorization error (401) in .net core when calling api to api in windows authentication
body: <p>Have 2 Web API's created using .Net Core 2.0 and hosted internally in IIS under windows authentication (anonymous disabled) on same server. Both API's run on same service account as well with appropriate permissions/rolegroups in Active Directory. However, get 401 unauthorized error when consuming one API from the other. Using HTTPClient to make API calls. Note that, it works when accessing the 2nd API endpoint directly via browser but not from another API.</p>
  
  <p>Decorated with Authorize filter in controller </p>
  
  <pre><code>[Authorize(Policy = "ValidRoleGroup")]
  </code></pre>
  
  <p>Start up code in ConfigureServices in both api services as below.</p>
  
  <pre><code>services.AddAuthentication(IISDefaults.AuthenticationScheme);
  services.AddAuthorization(options =&gt;
  {
      options.AddPolicy("ValidRoleGroup", policy =&gt; policy.RequireRole(Configuration["SecuritySettings:ValidRoleGroup"]));
  });
  
  services.AddMvc(configure =&gt;
  {
      var policy = new AuthorizationPolicyBuilder()
          .RequireAuthenticatedUser()
          .Build();
  
      configure.Filters.Add(new AuthorizeFilter(policy));
  });
  
  services.Configure&lt;IISOptions&gt;(options =&gt;
  {
      options.AutomaticAuthentication = true;
      options.ForwardClientCertificate = true;
  });
  
  services.AddMvc();
  services.AddScoped&lt;HttpClient&gt;(c =&gt; new HttpClient(new HttpClientHandler()
  {
      UseDefaultCredentials = true,
      PreAuthenticate = true,
      ClientCertificateOptions = ClientCertificateOption.Automatic,
  }));
  
  services.Configure&lt;ForwardedHeadersOptions&gt;(options =&gt;
  {
      options.ForwardedHeaders =
          ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
  });
  </code></pre>