@atripp, you recommend moving to "a modern, more secure technology." Is OIDC on ProGet's roadmap for feed authentication? Because today WIA is the only passwordless option for secured access in Proget -- the alternative is static, long-lived API keys -- and SAML does not help here, since it requires an interactive browser login and so cannot authenticate automated CI/CD pipelines.

Upgrading ProGet from 2024 to 26.0.10 forced us off IIS onto the Integrated Web Server. The host is shared with another application on port 443, so ProGet uses a hostname binding (https://proget.[domain]:443) and the IWS runs on HTTP.sys.

Under IIS we had Windows Integrated Authentication on the NuGet feeds with a few feeds (PowerShell via PSResourceGet, npm) exempted for API keys. On HTTP.sys the "Disable On" list and bypassIntegrated=true have no effect, since the Negotiate challenge is issued in the kernel; an exempted feed becomes unreachable for everyone, because Windows callers are treated as anonymous and API-key callers never pass the challenge.

A wildcard binding would select Kestrel, but we cannot take the whole port on every IP. If the Web Server URL is bound to an IP literal (https://[second IP]:443) instead of a hostname, does the IWS select Kestrel or HTTP.sys? Is there any supported way to get Kestrel with selective WIA while another application keeps port 443 on the same machine, short of a dedicated host or a non-standard port?

The root of the issue is the NuGet team's decision to force SemVer: https://github.com/NuGet/Home/issues/3050