Honor explicit Unix NegotiateAuthentication server packages by rzikm · Pull Request #136958 · dotnet/runtime

rzikm · 2026-11-04T08:14:34Z

Summary

Unix NegotiateAuthentication servers using default credentials currently acquire GSSAPI acceptor credentials for all mechanisms, regardless of NegotiateAuthenticationServerOptions.Package. Consequently, a server requesting Kerberos can accept NTLM, and a server requesting NTLM can accept Kerberos. Windows already restricts the server to the explicitly selected package.

Pass the requested package through acceptor credential acquisition and restrict GSSAPI credentials to the Kerberos or NTLM mechanism as appropriate.
Reject completed server contexts whose protocol does not match an explicitly requested package, including credential paths that may acquire broader credentials.
Preserve the default Negotiate behavior, including NTLM fallback, and document the explicit-package restriction.
Add wrong-package rejection coverage, case-insensitive package checks, and successful same-package/Negotiate controls. Use a server-specific NTLM capability check so these initial-token tests run with OpenSSL 3 without enabling tests that require broken NTLM response generation.

Related discussion: #136154 (comment)

Compatibility

This intentionally changes Unix server behavior to match Windows: applications that previously relied on an explicit package accepting another mechanism must use Negotiate instead. Explicit mechanism credentials also reject SPNEGO-wrapped tokens; clients should select the server's explicit package, or the server should use Negotiate. Client package selection is unchanged.

Validation

Linux validation used an isolated WSL Ubuntu 25.10 checkout with the same source changes. Windows validation used a short subst path to avoid path-length failures.

Windows: R:\build.cmd clr+libs -rc release — passed.
Windows: .\.dotnet\dotnet.exe build src\libraries\System.Net.Security\tests\UnitTests\System.Net.Security.Unit.Tests.csproj /t:Test /p:RuntimeConfiguration=Release /p:XunitClassName=System.Net.Security.Tests.NegotiateAuthenticationTests — 28 total, 0 failed, 4 skipped.
Linux: ./build.sh clr+libs -rc release and ./build.sh libs -rc release — passed.
Linux: dotnet build src/libraries/System.Net.Security/tests/FunctionalTests/System.Net.Security.Tests.csproj /t:Test /p:RuntimeConfiguration=Release /p:XunitClassName=System.Net.Security.Tests.NegotiateAuthenticationKerberosTest — before the fix, all four wrong-package cases failed because NTLM returned ContinueNeeded or Kerberos returned Completed; after the fix, all 15 cases passed without skips.
Linux: dotnet build src/libraries/System.Net.Security/tests/FunctionalTests/System.Net.Security.Tests.csproj /t:Test /p:RuntimeConfiguration=Release — 5,143 total, 0 failed, 8 skipped.
Linux: dotnet build src/libraries/System.Net.Security/tests/UnitTests/System.Net.Security.Unit.Tests.csproj /t:Test /p:RuntimeConfiguration=Release — 138 total, 1 failed, 12 skipped. The existing Package_Unsupported_NTLM test expects Unsupported but receives ContinueNeeded because its availability predicate excludes OpenSSL 3 and does not enable managed NTLM on Ubuntu 25.10. Reverting the product fix and rebuilding reproduced the identical failure and counts.
git diff --check — passed.

macOS was not exercised. The Kerberos functional class is unsupported on Windows; it was not counted as Windows execution coverage.

Note

This pull request and its description were created with GitHub Copilot.

Restrict GSSAPI acceptor credentials to the requested Kerberos or NTLM mechanism and reject completed contexts using another protocol. Preserve Negotiate fallback and add package restriction regression coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

azure-pipelines · 2026-11-04T08:15:25Z

Azure Pipelines: Successfully started running 4 pipeline(s). 11 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-11-04T08:15:59Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Preserve the explicit server package restriction alongside upstream NTLM guidance. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Reconcile the interrupted local main merge with the existing remote merge without rewriting either history. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Exclude macOS from default NTLM acceptor tests while retaining Kerberos coverage. Require a successful NTLM server challenge before asserting rejection of a Kerberos token. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

rzikm · 2026-11-09T09:22:01Z

/ba-g test failure is unrelated

rzikm · 2026-11-09T09:22:51Z

/backport to release/11.0

github-actions · 2026-11-09T09:23:00Z

Started backporting to release/11.0 (link to workflow run)

rzikm · 2026-11-09T09:23:01Z

/backport to release/10.0

github-actions · 2026-11-09T09:23:15Z

Started backporting to release/10.0 (link to workflow run)

github-actions · 2026-11-09T09:24:57Z

@rzikm backporting to release/11.0 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git cherry-pick 796e892b9fb442e08cae8366c27e2cbde3f08c72

Auto-merging src/libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs
Auto-merging src/libraries/Common/tests/System/Net/Capability.Security.Unix.cs
Auto-merging src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
CONFLICT (content): Merge conflict in src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
Auto-merging src/libraries/Common/tests/System/Net/Security/Kerberos/KerberosExecutor.cs
Auto-merging src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unix.cs
Auto-merging src/libraries/System.Net.Security/src/System/Net/Security/NegotiateAuthenticationServerOptions.cs
CONFLICT (content): Merge conflict in src/libraries/System.Net.Security/src/System/Net/Security/NegotiateAuthenticationServerOptions.cs
Auto-merging src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.cs
Auto-merging src/native/libs/System.Net.Security.Native/pal_gssapi.c
Auto-merging src/native/libs/System.Net.Security.Native/pal_gssapi.h
error: could not apply 796e892b9fb... Honor explicit Unix NegotiateAuthentication server packages (#136958)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"


$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Honor explicit Unix NegotiateAuthentication server packages
Using index info to reconstruct a base tree...
M	src/libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs
M	src/libraries/Common/tests/System/Net/Capability.Security.Unix.cs
M	src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
M	src/libraries/Common/tests/System/Net/Security/Kerberos/KerberosExecutor.cs
M	src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unix.cs
M	src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.cs
M	src/native/libs/System.Net.Security.Native/pal_gssapi.c
M	src/native/libs/System.Net.Security.Native/pal_gssapi.h
Falling back to patching base and 3-way merge...
Auto-merging src/libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs
Auto-merging src/libraries/Common/tests/System/Net/Capability.Security.Unix.cs
Auto-merging src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
CONFLICT (content): Merge conflict in src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
Auto-merging src/libraries/Common/tests/System/Net/Security/Kerberos/KerberosExecutor.cs
Auto-merging src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unix.cs
Auto-merging src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.cs
Auto-merging src/native/libs/System.Net.Security.Native/pal_gssapi.c
Auto-merging src/native/libs/System.Net.Security.Native/pal_gssapi.h
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Honor explicit Unix NegotiateAuthentication server packages
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output

github-actions · 2026-11-09T09:25:22Z

@rzikm backporting to release/10.0 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git cherry-pick 796e892b9fb442e08cae8366c27e2cbde3f08c72

Auto-merging src/libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs
Auto-merging src/libraries/Common/tests/System/Net/Capability.Security.Unix.cs
CONFLICT (content): Merge conflict in src/libraries/Common/tests/System/Net/Capability.Security.Unix.cs
Auto-merging src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
CONFLICT (content): Merge conflict in src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
Auto-merging src/libraries/Common/tests/System/Net/Security/Kerberos/KerberosExecutor.cs
Auto-merging src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unix.cs
Auto-merging src/libraries/System.Net.Security/src/System/Net/Security/NegotiateAuthenticationServerOptions.cs
CONFLICT (content): Merge conflict in src/libraries/System.Net.Security/src/System/Net/Security/NegotiateAuthenticationServerOptions.cs
Auto-merging src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.cs
Auto-merging src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs
CONFLICT (content): Merge conflict in src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs
Auto-merging src/native/libs/System.Net.Security.Native/pal_gssapi.c
Auto-merging src/native/libs/System.Net.Security.Native/pal_gssapi.h
error: could not apply 796e892b9fb... Honor explicit Unix NegotiateAuthentication server packages (#136958)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"


$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Honor explicit Unix NegotiateAuthentication server packages
Using index info to reconstruct a base tree...
M	src/libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs
M	src/libraries/Common/tests/System/Net/Capability.Security.Unix.cs
M	src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
M	src/libraries/Common/tests/System/Net/Security/Kerberos/KerberosExecutor.cs
M	src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unix.cs
M	src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.cs
M	src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs
M	src/native/libs/System.Net.Security.Native/pal_gssapi.c
M	src/native/libs/System.Net.Security.Native/pal_gssapi.h
Falling back to patching base and 3-way merge...
Auto-merging src/libraries/Common/src/Interop/Unix/System.Net.Security.Native/Interop.NetSecurityNative.cs
Auto-merging src/libraries/Common/tests/System/Net/Capability.Security.Unix.cs
CONFLICT (content): Merge conflict in src/libraries/Common/tests/System/Net/Capability.Security.Unix.cs
Auto-merging src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
CONFLICT (content): Merge conflict in src/libraries/Common/tests/System/Net/Capability.Security.Windows.cs
Auto-merging src/libraries/Common/tests/System/Net/Security/Kerberos/KerberosExecutor.cs
Auto-merging src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unix.cs
Auto-merging src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.cs
Auto-merging src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs
CONFLICT (content): Merge conflict in src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs
Auto-merging src/native/libs/System.Net.Security.Native/pal_gssapi.c
Auto-merging src/native/libs/System.Net.Security.Native/pal_gssapi.h
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Honor explicit Unix NegotiateAuthentication server packages
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output

…kages (#137246) Fixes Issue  N/A; reported in #136154 (comment). main PR  #136958 # Customer Impact  A Unix server explicitly configured for Kerberos can accept NTLM, and a server configured for NTLM can accept Kerberos. Applications cannot rely on the selected server package to enforce their intended authentication protocol. # Regression  No known recent regression; this corrects a longstanding Unix/Windows behavioral inconsistency. # Testing Added tests that check this in CI. # Risk Small, this makes the behavior consistent across platforms, so we may break folks who rely on the inconsistent behavior, but that is exactly what we want to fix. > [!NOTE] > This backport and its description were prepared with GitHub Copilot. --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…kages (#137245) Fixes Issue  N/A; reported in #136154 (comment). main PR  #136958 # Customer Impact  A Unix server explicitly configured for Kerberos can accept NTLM, and a server configured for NTLM can accept Kerberos. Applications cannot rely on the selected server package to enforce their intended authentication protocol. # Regression  No known recent regression; this corrects a longstanding Unix/Windows behavioral inconsistency. # Testing Added tests that check this in CI. # Risk Small, this makes the behavior consistent across platforms, so we may break folks who rely on the inconsistent behavior, but that is exactly what we want to fix. > [!NOTE] > This backport and its description were prepared with GitHub Copilot. --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

MacCatalyst advertises NTLM but cannot supply the default NTLM acceptor credentials used by `ServerPackage_Supported_NTLM`, causing `UnknownCredentials` instead of `ContinueNeeded` for `Negotiate`, `NTLM`, and `nTlM`. Extend the existing macOS capability exclusion added in #136958 to MacCatalyst. `OperatingSystem.IsMacOS()` does not include MacCatalyst. This changes test applicability only; assertions and product behavior are unchanged. Validation on Windows: - `R:\build.cmd clr+libs -rc release`: passed (baseline). - `.\.dotnet\dotnet.exe build src\libraries\System.Net.Security\tests\UnitTests\System.Net.Security.Unit.Tests.csproj /t:Test /p:RuntimeConfiguration=Release`: passed, 120 passed and 4 skipped, including all three NTLM server theory inputs. Windows uses a separate capability helper. The changed Unix helper and MacCatalyst applicability have not been executed locally on Apple platforms. > [!NOTE] > This pull request description and fix were generated with GitHub Copilot. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions Bot added the area-System.Net.Security label Nov 4, 2026

dotnet-policy-service Bot assigned rzikm Nov 4, 2026

rzikm requested a review from a team November 4, 2026 08:27

This was referenced Nov 4, 2026

Crash: access violation in coreclr!PgoManager::getPgoInstrumentationResults during tier-1 background JIT (Windows x86) #134695

Open

Test failure: IdsConversionsWithRegionTest America/Vancouver America/Los_Angeles mismatch #136758

Closed

filipnavara approved these changes Nov 4, 2026

View reviewed changes

wfurt approved these changes Nov 4, 2026

View reviewed changes

Merge branch 'main' into unix-negotiate-server-package

886506f

wfurt approved these changes Nov 4, 2026

View reviewed changes

This was referenced Nov 5, 2026

slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883

Open

Helix: System.IO.IOException: No space left on device #128758

Open

rzikm and others added 3 commits November 5, 2026 16:56

Merge main into unix-negotiate-server-package

245c80f

Preserve the explicit server package restriction alongside upstream NTLM guidance. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Merge published PR history into local branch

e2e300d

Reconcile the interrupted local main merge with the existing remote merge without rewriting either history. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

wfurt approved these changes Nov 5, 2026

View reviewed changes

rzikm merged commit 796e892 into dotnet:main Nov 9, 2026
99 of 101 checks passed

dotnet-maestro Bot mentioned this pull request Nov 10, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#10849

Merged

dotnet-milestone-bot Bot added this to the 12.0-preview1 milestone Nov 10, 2026

This was referenced Nov 10, 2026

[release/11.0] Honor explicit Unix NegotiateAuthentication server packages #137245

Merged

[release/10.0] Honor explicit Unix NegotiateAuthentication server packages #137246

Merged

rzikm mentioned this pull request Nov 12, 2026

Correct NTLM server test availability on MacCatalyst #137410

Merged

Navigation Menu

Repository navigation

Honor explicit Unix NegotiateAuthentication server packages - #136958

Honor explicit Unix NegotiateAuthentication server packages#136958
rzikm merged 5 commits into
dotnet:mainfrom
rzikm:unix-negotiate-server-package

rzikm commented Nov 4, 2026

Uh oh!

azure-pipelines Bot commented Nov 4, 2026

Uh oh!

dotnet-policy-service Bot commented Nov 4, 2026

Uh oh!

rzikm commented Nov 9, 2026

Uh oh!

Uh oh!

rzikm commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

rzikm commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

rzikm commented Nov 4, 2026

Summary

Compatibility

Validation

Uh oh!

azure-pipelines Bot commented Nov 4, 2026

Uh oh!

dotnet-policy-service Bot commented Nov 4, 2026

Uh oh!

rzikm commented Nov 9, 2026

Uh oh!

Uh oh!

rzikm commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

rzikm commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants