@jrodrigu Hey mate, champion effort for this. I actually just used your Authenticator plugin class code (copy and paste) , add this line to the Startup.ConfigureServices,
public void ConfigureServices(IServiceCollection services) {
// Comes with non-trivial performance effects, but we need this for NTLM auth
// See: https://github.com/aspnet/Hosting/issues/793?WT.mc_id=-blog-scottha
services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
}
, turned on Http.Sys as the webserver instead of Kestrel (because I run using IIS instead of IISExpress because IISExpress seems to crash a lot of me, and Kestrel doesnt support NTML), and it … seems to… just work?! 
To outline my steps, I patched Program.BuildWebHost to be:
/// <summary>
/// Following instructions here: https://stackify.com/how-to-deploy-asp-net-core-to-iis/
/// To run under IIS, make sure you:
/// -- Install .NET Core Windows Server Hosting Bundle (https://go.microsoft.com/fwlink/?linkid=844461)
/// -- If you get errors about "500.19 module, your webconfig is invalid", you might need to install
/// the HttpPlatformHandler is a new component that connects IIS with your ASP.NET Core application. Go:
/// http://go.microsoft.com/fwlink/?LinkID=690721
/// </summary>
/// <param name="args"></param>
/// <returns></returns>
public static IWebHost BuildWebHost(string[] args)
{
return new WebHostBuilder()
// 28.08.2018 D.Holborow notes: Originally for development purposes we used either IISExpress OR Kestrel.
// However, Kestrel does not support NTLM Auth, so investigations revealed that to enable NTLM in .NETCORE,
// one should instead use the HttpSys webserver, as per the documentation link.
// 28.08.2018 D.Holborow : *commented out the use of Kestrel*
// Next line registers the IServer interface for Kestrel as the server that will be used to host your application.
// In the future, there could be other options, including WebListener which will be Windows only.
// .UseKestrel()
//// 28.08.2018 D.Holborow : Http.Sys is the rebranded name of WebListener, I believe. Use this webserver instead
//// so that we can access NTLM authentication.
//// See https://docs.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-2.1#enable-windows-authentication-with-httpsys
.UseHttpSys(options =>
{
options.Authentication.Schemes = AuthenticationSchemes.NTLM | AuthenticationSchemes.Negotiate;
options.Authentication.AllowAnonymous = false;
})
.etc ....
I haven’t thrashed it extensively yet, so I cannot confirm that its 100% rock solid, but its definitely looking promising.
If i switch to IISExpress, that DOES seem to support NTLM out of the box as well, so the Kestrel->HttpSys change is not required (note: IISExpress seems to crash when HttpSys is used, so the choice is IISExpress+Kestrel OR IIS+HttpSys).
I’ll edit your authenticator class, because as you note, your network-based roles etc are irrelevant for me, but still -> this saved my bacon!
@mythz its worth noting that .NETCORE does seem to have the capability to support NTLM now (for all us devs stuck with Luddite customers 
), so I might try to write up a blog post or something at some point, or you can drop it into your support notes somewhere.
so no jwt for me