Kestrel drops "400 bad request" when using app.UseAuthentication() behind IIS reverse proxy

using System.Text.Json.Serialization;
using Microsoft.AspNetCore.Authentication.Negotiate;
using Microsoft.AspNetCore.Authorization;
using System.DirectoryServices.AccountManagement;

var builder = WebApplication.CreateBuilder(args);

builder.Services.ConfigureHttpJsonOptions(options =>
{
    options.SerializerOptions.TypeInfoResolver = AppJsonContext.Default;
});
builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme)
       .AddNegotiate();


var app = builder.Build();
app.UseAuthentication();
app.MapGet("/hello", () => new Message("Hello, world!"));
app.Run("http://localhost:5000");

public record Message(string Text);
[JsonSerializable(typeof(Message))]
internal partial class AppJsonContext : JsonSerializerContext
{
}