RunAs plugin fails to authenticate in the application when the build agent is hosted on a Windows Server

Symptoms

• The RunAs plugin is used to run a Microsoft Playwright test (dotnet test) that logs in to an application using Windows Authentication.
• When the build agent hosted on a Windows Server machine is used, the test fails with an Access is denied error message.
• When the build agent hosted on a Windows 10 machine is used, the test passes with no authentication errors.

Cause

There are differences in the authentication in Windows Server and Windows 10:

• On Windows 10, CredentialCache.DefaultCredentials or UseDefaultCredentials = true work transparently.
• On Windows Server, no credentials are sent if the URL is not considered an Intranet, and authentication fails.

Resolution

1. Log in to the Windows Server machine with the TeamCity build agent installed using the same account that will be running the tests (the account specified in the RunAs plugin).
2. Open the Control Panel > Internet Options > Security tab.
3. Go to Local Intranet > Sites > Advanced.
4. Add all hostnames that the tests will access, e.g. https://webserver.domain.com. Wildcards are permitted.
5. Back on the Security tab, select Custom Level… for the Local Intranet zone.
6. Under User Authentication > Logon, select Automatic logon only in Intranet zone.
7. Optional: If you want to get rid of ESC (Internet Explorer Enhanced Security Configuration) entirely (for testing purposes only, not a recommended solution): Server Manager > Local Server > IE Enhanced Security Configuration > Off.

Additional information

Internet Explorer Enhanced Security Configuration (ESC) is a Windows Server–only feature that Microsoft turned on by default to reduce the risk of accidentally downloading or running malicious content when browsing from a server. Disabling ESC is discouraged in production scenarios as it may introduce security risks.