Proget HTTP.Sys vs Kestrel: IP literal behavior?

[seanl_4808]

Upgrading ProGet from 2024 to 26.0.10 forced us off IIS onto the Integrated Web Server. The host is shared with another application on port 443, so ProGet uses a hostname binding (https://proget.[domain]:443) and the IWS runs on HTTP.sys.

Under IIS we had Windows Integrated Authentication on the NuGet feeds with a few feeds (PowerShell via PSResourceGet, npm) exempted for API keys. On HTTP.sys the "Disable On" list and bypassIntegrated=true have no effect, since the Negotiate challenge is issued in the kernel; an exempted feed becomes unreachable for everyone, because Windows callers are treated as anonymous and API-key callers never pass the challenge.

A wildcard binding would select Kestrel, but we cannot take the whole port on every IP. If the Web Server URL is bound to an IP literal (https://[second IP]:443) instead of a hostname, does the IWS select Kestrel or HTTP.sys? Is there any supported way to get Kestrel with selective WIA while another application keeps port 443 on the same machine, short of a dedicated host or a non-standard port?

[atripp]

Hi @seanl_4808 ,

First and foremost, we recommend that you move away from Windows Integrated Authentication as Microsoft is discontinuing the technology and move to a modern, more secure technology. It's only going to be a matter of time before WIA stops working altogether due to bugs or removal of support by us or Microsoft.

That said, WIA is pretty limited as you can see. However, you can try configuring IIS as a reverse proxy that forwards https://hostname:443 to http/:*:8624; that may also make certificate management easier. We don't have a guide to set that up, however; I'v eonly heard of one customer who made it work somehow with WIA.

Thanks,
Alana