title: .NET Core and IIS Intermittent 403 Access Denied
body: <p>Alright Stackoverflow, after much fruitless research I've ended up here!</p>
  
  <p>I am attempting to get a .NET Core 2.0 site hosted out of IIS with Windows Authentication and SSL, and no matter what I try I continue to get inconsistent/intermittent 403 Access Denied errors. </p>
  
  <p>If there was something dead-wrong, I would expect it never to work. However, it works maybe ~3/10 times if I restart the site and the app pool. There is nothing useful that I can find in the Event Viewer, Application Logs, or IIS trace logs.</p>
  
  <p>Things I have done in no particular order:</p>
  
  <ol>
  <li>The app pool is running as a gmsa account with rights to my database (prod.service$)</li>
  <li>Granted log on as a service, and log on as batch to the gmsa account.</li>
  <li>Granted IIS_IUSRS, prod.service$, and Domain Users permissions on the web root folder. Currently at full-control out of despair.</li>
  <li>Granted IIS_IUSRS, prod.service$, and Domain Users permissions to the certificate.</li>
  <li>Enabled Windows Auth, Disabled Anonymous Auth</li>
  <li>Set default document pointing to the front-page.</li>
  <li>Set the app pool to "Load Profile"</li>
  <li>Set the .NET CLR version to "No Managed Code"</li>
  <li>Set ForwardWindowsAuthToken to true in the web.config</li>
  <li>NTLM has been moved to the top of the list as the first auth provider under Site > Authentication > Right-Click Windows Authentication > Providers</li>
  </ol>
  
  <p>One more detail is that I am trying to authenticate with users from a different domain, where a one-way trust is set up. I am remoting into the host with credentials from the 'other' domain, so it has visibility.</p>
  
  <p>Here is my web.config:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
    &lt;system.webServer&gt;
      &lt;handlers&gt;
        &lt;add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified" /&gt;
      &lt;/handlers&gt;
      &lt;aspNetCore processPath="dotnet" arguments=".\MCP.MVP.dll" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="true" startupTimeLimit="3600" requestTimeout="23:00:00" /&gt;
      &lt;defaultDocument&gt;
          &lt;files&gt;
              &lt;add value="/home/index" /&gt;
          &lt;/files&gt;
      &lt;/defaultDocument&gt;
    &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  
  &lt;!--ProjectGuid: [REDACTED] --&gt;
  </code></pre>
  
  <p>From Startup.cs:</p>
  
  <pre><code>services.AddAuthentication(IISDefaults.AuthenticationScheme);    
  services.Configure&lt;IISOptions&gt;(options =&gt; 
      {
          options.AutomaticAuthentication = true;
      });
  </code></pre>
  
  <p>From Program.cs</p>
  
  <pre><code>public static IWebHost BuildWebHost(string[] args) =&gt;
      WebHost.CreateDefaultBuilder(args)
      .UseIISIntegration()
      .UseStartup&lt;Startup&gt;()
      .Build();
  </code></pre>
  
  <p>Using Authorize attributes everywhere:</p>
  
  <pre><code>[Authorize(Policy = "RequireViewerRole")]
  </code></pre>
  
  <p>Authorization Glue, where Configuration["RequireViewerRoles"] is a comma delimited list of domain groups:</p>
  
  <pre><code>services.AddAuthorization(options =&gt;
          {
              options.AddPolicy("RequireViewerRole", policy =&gt; policy.RequireRole(Configuration["RequireViewerRoles"].Split(',')));
          });
  </code></pre>
  
  <p>Have I entered .NET Core 2.0 bug territory, or am I missing something?</p>