title: Fallback to Basic authentication if Windows authentication fails
body: <p>I have the following requirements for my ASP.NET MVC application </p>
  
  <ol>
  <li><p>The first GET request sent to a specific page should be authenticated by Windows Authentication.</p></li>
  <li><p>Based on some database checks, user could be recognized as unauthorized and the application should respond with 401.</p></li>
  <li><p>In this case the user should have a possibility to enter credentials of other account. Then second request should be sent to Web application with Basic authentication for entered credentials. Basic authentication is a must-have requirement here, because in this flow we perform impersonated access to the documents in network share (see <a href="https://blogs.msdn.microsoft.com/knowledgecast/2007/01/31/the-double-hop-problem/" rel="nofollow noreferrer">The Double-Hop Problem</a> for more details)</p></li>
  </ol>
  
  <p><strong>My problem:</strong></p>
  
  <p>I can't make the browser to fallback to Basic authentication and show the dialog for entering credentials. The browser receives response with <code>WWW-Authenticate</code> challenges for both Windows and Basic authentication, and just resends GET request with Windows authentication again.</p>
  
  <p>I do understand why this happens. According to <a href="https://blogs.msdn.microsoft.com/parvez/2013/09/21/authentication-precedence-in-iis/" rel="nofollow noreferrer">Authentication Precedence and Behavior in IIS</a>:</p>
  
  <blockquote>
    <p>The client picks up the most secure authentication mechanism(windows)
    from the list provided by the server and takes necessary steps to
    provide the required information to the server.</p>
  </blockquote>
  
  <p>However I can't limit the response to challenge only Basic authentication within my ASP.NET Application. Seems like <code>WWW-Authenticate</code> headers are added by IIS (somewhere inside <a href="https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/introduction-to-iis-architecture#security-modules" rel="nofollow noreferrer">Windows Authentication Module</a>) after ASP.NET pipeline. I'm returning <code>Unauthorized(new AuthenticationHeaderValue("Basic"))</code> from controller action however the final set of headers looks like:</p>
  
  <pre><code>WWW-Authenticate: Basic
  WWW-Authenticate: Negotiate
  WWW-Authenticate: NTLM
  WWW-Authenticate: Basic realm="localhost"
  </code></pre>
  
  <p>I see the only possible workaround for this problem: handle 401 response with some client code that will ask for user credentials (in own dialog) and send request with Basic authentication. I want to avoid this custom code and use the standard browser dialog.</p>
  
  <p>Here is Authentication configuration in IIS</p>
  
  <p><a href="https://i.stack.imgur.com/yhG5s.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yhG5s.jpg" alt="enter image description here"></a></p>
  
  <p>So my questions are:</p>
  
  <ol>
  <li><p>Is there possibility to suppress other authentication schemes in Unauthorized response of ASP.NET application?
  This will allow to respond only with <code>WWW-Authenticate: Basic</code> and will not leave a choice to browser except to use Basic authentication.</p></li>
  <li><p>If no, is there any other way I can have both Windows and Basic authentication for my application, and fallback to Basic authentication if request with Windows authentication fails?</p></li>
  </ol>