title: Windows authentication across untrusted domains
body: <p>I'm developing an ASP.NET Web API which implements also an Identity provider using Identity Server. The requirement is to support Windows Authentication via Active Directory, and also Custom credentials. </p>
  
  <p>All these requirements are achievable. An extra requirement is to support Win Auth from different untrusted domains. </p>
  
  <p>Recap:</p>
  
  <ul>
  <li>Three untrusted domain (A, B, C)</li>
  <li>the ASP.net Core service runs (using HTTP.SYS and not behind IIS) on a server joined to domain A</li>
  <li>a user from domain B wants to login using Windows Authentication (preferable SSO) using domainB\userB</li>
  </ul>
  
  <p>I've googled and it doesn't seem possible.</p>
  
  <p>It's an option to migrate to Kestrel 3.0, but Microsoft says <a href="https://docs.microsoft.com/en-us/aspnet/core/release-notes/aspnetcore-3.0?view=aspnetcore-3.0" rel="nofollow noreferrer">here</a></p>
  
  <blockquote>
    <p>In ASP.NET Core 3.0, Kestrel has the ability to use Negotiate, Kerberos, and NTLM on Windows, Linux, and macOS for Windows domain-joined hosts</p>
  </blockquote>
  
  <p>so supports only <strong>domain joined hosts</strong>.</p>
  
  <p>My understanding is that LDAP could support untrusted domains, is this true?</p>
  
  <p>Thanks,</p>