title: ASP.NET Core 3.0: How to forward an existing authentication to another request - double hop problem?
body: <p>I've got the following scenario (all applications and services are using asp.net core 3.0 on Windows):</p>
  
  <p>I have a client application that runs in the context of AppUser. It uses an HttpClient to send a request to WebServiceA that runs in the context of WebUser.
  The request uses Windows authentication.</p>
  
  <pre><code>    var credentialsCache = new CredentialCache { { uri, "Negotiate", CredentialCache.DefaultNetworkCredentials } };
      var handler = new HttpClientHandler { Credentials = credentialsCache };
      var httpClient = new HttpClient(handler);
  </code></pre>
  
  <p>In WebServiceA, the call is recieved correctly and it's authenticated:
  <code>HttpContext.User.Identity.IsAuthenticated</code> is true and <code>HttpContext.User.Identity.Name</code> is AppUser.</p>
  
  <p>To be able to process the request, WebServiceA must send another request to WebServiceB. <strong>This request must also be authenticated as AppUser</strong>.</p>
  
  <p>Currently I'm using the following code to create the HttpClient that makes the request to WebServiceB:</p>
  
  <pre><code>    var credentialsCache = new CredentialCache { { uri, "Negotiate", CredentialCache.DefaultNetworkCredentials } };
      HttpClientHandler handler = new HttpClientHandler
      {
          Credentials = credentialsCache,
          UseDefaultCredentials = true
      };
      HttpClient httpClient = new HttpClient(handler);
  </code></pre>
  
  <p>The problem is, <strong>the call is always authenticated as WebUser (who runs the service), NOT AppUser (who sent the request)</strong>.</p>
  
  <p>I thought the DefaultNetworkCredentials were always those of the authenticated user.</p>
  
  <p>How can I send (from within a WebRequest) another WebRequest to another WebService that is authenticated with the same user who submitted the original request?
  Is there a way to pass the authentication from one WebService to another?</p>
  
  <p>Regarding Kerberos and AD:
  WebServiceA and WebServiceB are running on different servers in the same domain. They are not hosted in IIS, but in a Windows Service.</p>
  
  <p>I tried to set the SPN as described here:
  <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-3.0&amp;tabs=visual-studio" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-3.0&amp;tabs=visual-studio</a></p>
  
  <p><code>setspn -S HTTP/ServerA.domain domain\WebUser</code></p>
  
  <p>Also tried:
  <code>setspn -a WebServiceA/WebUser domain\WebUser</code></p>
  
  <p>But without success.</p>
  
  <p>After three days of web research and trying around, my head is spinning ...
  How do I get the UserCredentials into the second request?
  Or is it because of (a possibly wrong?) AD configuration (SPN) that the WebService always silently takes the credentials of the user who started the service?</p>
  
  <p>I am grateful for every hint!</p>
  
  <p>Steffi</p>