Using Network Creds in dotnet core app on a mac using HttpClient

Writing a dotnet core app. I need to log in with network credentials as the service (which happens to be a TFS on-prem server) uses those to authenticate. From my (and another team members') windows machine, the following code works:

Console.WriteLine("Type in your DOMAIN password:");
var pass = GetPassword(); //command line secure string magic from SO
var networkCredential = new NetworkCredential("USERNAME", pass, "DOMAINNAME");
string tfsDefaultCollection = "https://TFSURL/DefaultCollection";

string testUrl = $"{tfsDefaultCollection}/_apis/tfvc/changesets/1234/changes?api-version=2.2";

var httpClientHandler = new HttpClientHandler
{
    Credentials = networkCredential
};

var client = new HttpClient(httpClientHandler)
{
    BaseAddress = new Uri(testUrl)
};
httpClientHandler.PreAuthenticate = true;

var test = client.GetAsync(testUrl).Result;

Console.WriteLine(test);

But it doesn't work from my mac. I get a 401 unauthorized. Both used the same, hardwired connection. AND this works on my mac:

curl --ntlm --user "DOMAINNAME\USERNAME" "https://TFSURL/DefaultCollection/_apis/tfvc/changesets/1234/changes?api-version=2.2"

So that rules out a connectivity question, I would think. Am I missing something I need to be doing on my mac? Can anybody point me to some documentation or way to troubleshoot what both of these requests are doing at the lowest level to see if there is a difference?

Well finally some google-foo got me there. There's a bug in dotnet core for linux/mac. This issue describes the fix:

https://github.com/dotnet/corefx/issues/25988#issuecomment-412534360

It has to do with the host machine you are connecting to uses both Kerberos and NTLM authentication methods.

Implemented below:

AppContext.SetSwitch("System.Net.Http.UseSocketsHttpHandler", false);

Console.WriteLine("Type in your DOMAIN password:");
var pass = GetPassword(); //command line secure string magic from SO
var networkCredential = new NetworkCredential("USERNAME", pass, "DOMAINNAME");
string tfsDefaultCollection = "https://TFSURL/DefaultCollection";

string testUrl = $"{tfsDefaultCollection}/_apis/tfvc/changesets/1234/changes?api-version=2.2";

var myCache = new CredentialCache
{
    {
        new Uri(testUrl), "NTLM",
        networkCredential
    }
};

var httpClientHandler = new HttpClientHandler
{
    Credentials = myCache
};

var client = new HttpClient(httpClientHandler)
{
    BaseAddress = new Uri(testUrl)
};
httpClientHandler.PreAuthenticate = true;

var test = client.GetAsync(testUrl).Result;

Console.WriteLine(test);

Thanks to @dmcgill50 for getting me on the right googling track.