[rzikm]

Summary

Unix NegotiateAuthentication servers using default credentials currently acquire GSSAPI acceptor credentials for all mechanisms, regardless of NegotiateAuthenticationServerOptions.Package. Consequently, a server requesting Kerberos can accept NTLM, and a server requesting NTLM can accept Kerberos. Windows already restricts the server to the explicitly selected package.

• Pass the requested package through acceptor credential acquisition and restrict GSSAPI credentials to the Kerberos or NTLM mechanism as appropriate.
• Reject completed server contexts whose protocol does not match an explicitly requested package, including credential paths that may acquire broader credentials.
• Preserve the default Negotiate behavior, including NTLM fallback, and document the explicit-package restriction.
• Add wrong-package rejection coverage, case-insensitive package checks, and successful same-package/Negotiate controls. Use a server-specific NTLM capability check so these initial-token tests run with OpenSSL 3 without enabling tests that require broken NTLM response generation.

Related discussion: #136154 (comment)

Compatibility

This intentionally changes Unix server behavior to match Windows: applications that previously relied on an explicit package accepting another mechanism must use Negotiate instead. Explicit mechanism credentials also reject SPNEGO-wrapped tokens; clients should select the server's explicit package, or the server should use Negotiate. Client package selection is unchanged.

Validation

Linux validation used an isolated WSL Ubuntu 25.10 checkout with the same source changes. Windows validation used a short subst path to avoid path-length failures.

• Windows: R:\build.cmd clr+libs -rc release — passed.
• Windows: .\.dotnet\dotnet.exe build src\libraries\System.Net.Security\tests\UnitTests\System.Net.Security.Unit.Tests.csproj /t:Test /p:RuntimeConfiguration=Release /p:XunitClassName=System.Net.Security.Tests.NegotiateAuthenticationTests — 28 total, 0 failed, 4 skipped.
• Linux: ./build.sh clr+libs -rc release and ./build.sh libs -rc release — passed.
• Linux: dotnet build src/libraries/System.Net.Security/tests/FunctionalTests/System.Net.Security.Tests.csproj /t:Test /p:RuntimeConfiguration=Release /p:XunitClassName=System.Net.Security.Tests.NegotiateAuthenticationKerberosTest — before the fix, all four wrong-package cases failed because NTLM returned ContinueNeeded or Kerberos returned Completed; after the fix, all 15 cases passed without skips.
• Linux: dotnet build src/libraries/System.Net.Security/tests/FunctionalTests/System.Net.Security.Tests.csproj /t:Test /p:RuntimeConfiguration=Release — 5,143 total, 0 failed, 8 skipped.
• Linux: dotnet build src/libraries/System.Net.Security/tests/UnitTests/System.Net.Security.Unit.Tests.csproj /t:Test /p:RuntimeConfiguration=Release — 138 total, 1 failed, 12 skipped. The existing Package_Unsupported_NTLM test expects Unsupported but receives ContinueNeeded because its availability predicate excludes OpenSSL 3 and does not enable managed NTLM on Ubuntu 25.10. Reverting the product fix and rebuilding reproduced the identical failure and counts.
• git diff --check — passed.

macOS was not exercised. The Kerberos functional class is unsupported on Windows; it was not counted as Windows execution coverage.

Note

This pull request and its description were created with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.