ASP.NET Core 9.0 Blazor基于IP选择认证方案的技术问询

我需要开发一款Blazor应用，实现基于IP地址自动切换认证方式：内网用户使用集成Active Directory的Windows认证，外网用户使用OpenId Connect（OIDC）认证。网站部署于IIS，目前已尝试以下认证配置：

.AddPolicyScheme("SmartAuth", "SmartAuth", o =>
 {
   o.ForwardDefaultSelector = context =>
   {
     var hasCookie = context.Request.Cookies.ContainsKey(".AspNetCore.Cookies");
     if (hasCookie)
       return "Cookies";
     return IpAwareChallengeHandler.IsInternal(context) ? IISDefaults.AuthenticationScheme : "Cookies";
   };
 })
 .AddPolicyScheme("SmartChallenge", "SmartChallenge", o =>
 {
   o.ForwardDefaultSelector = context =>
   {
     var p = context.Request.Path;
     if (p.StartsWithSegments("/signin-oidc") || p.StartsWithSegments("/signout-callback-oidc"))
       return "oidc";
     return IpAwareChallengeHandler.IsInternal(context) ? IISDefaults.AuthenticationScheme : "oidc";
   };
 });

此外，还需结合自定义需求校验Negotiate认证，已配置如下授权策略：

builder.Services.AddAuthorizationBuilder()
  .AddPolicy("Access", p => p
    .AddAuthenticationSchemes(IISDefaults.AuthenticationScheme, NegotiateDefaults.AuthenticationScheme)
    .RequireAuthenticatedUser()
    .AddRequirements(new UserRequirement()));

内容的提问来源于stack exchange，提问作者Elias Dobler