title: ASP.NET Core 3.1 Web API - Disable Windows Authentication for Controllers not using it
body: <p>I'm working on an ASP.NET Core web application deployed on IIS, with two Controllers. The action methods under one controller are used by an intranet application so the controller uses windows authentication while the action methods under the other controller may be used from outside the intranet, thus the controller uses bearer token authorization.</p>
  <p>The authentication for both controllers works fine, until one point. If the bearer token authentication fails for an action method (for example, in case the bearer token expired) then I'm getting a popup from the browser asking  for credentials because IIS is sending back <em>WWW-Authenticate: Negotiate</em> and <em>WWW-Authenticate: NTLM</em> in the response headers. I assume this is happening because windows authentication is enabled in IIS per the entire web application. (I should probably specify that I have Anonymous Authentication enabled in IIS too).</p>
  <p><strong>Is there a way to prevent IIS from sending <em>WWW-Authenticate: Negotiate</em> and <em>WWW-Authenticate: NTLM</em> in the response headers when the bearer token authentication fails for action methods that do not use windows authentication?</strong></p>
  <p>I can replicate this very easily with a Startup class like the one below:</p>
  <pre><code>    public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddControllers();
              services.AddAuthentication().AddJwtBearer();
          }
  
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
  
              app.UseHttpsRedirection();
              app.UseRouting();
              app.UseAuthorization();
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapControllers();
              });
          }
      }
  </code></pre>
  <p>and a controller like the one below:</p>
  <pre><code> [Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
      [Route(&quot;[controller]&quot;)]
      [ApiController]
      public class BearerController : ControllerBase
      {
          // GET: /Bearer
          [HttpGet]
          public IEnumerable&lt;string&gt; Get()
          {
              return new string[] { &quot;value1&quot;, &quot;value2&quot; };
          }
      }
  </code></pre>
  <p>What I tried so far was setting the <code>DefaultChallengScheme, DefaultForbidScheme, DefaultSignInScheme</code> to <code>JwtBearerDefaults.AuthenticationScheme</code> from the callback passed to the <code>services.AddAuthentication</code> method but with no success.</p>
  <p>I also looked into disabling windows authentication for the controller that is not using it by changing the <code>web.config</code> of my web application but I did not find a way to disable it only for an URL path but just for the entire web application.</p>