Skip to content

fix import of SPN with Kerberos realm#126279

Merged
wfurt merged 7 commits intodotnet:mainfrom
wfurt:nego
Apr 22, 2026
Merged

fix import of SPN with Kerberos realm#126279
wfurt merged 7 commits intodotnet:mainfrom
wfurt:nego

Conversation

@wfurt
Copy link
Copy Markdown
Member

@wfurt wfurt commented Mar 29, 2026

Added to Enterprise suite to run agains real KDC

fixes #126979

@dotnet-policy-service
Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds NegotiateAuthentication EnterpriseTests to exercise real Kerberos/Negotiate flows against a real KDC, expanding System.Net.Security’s enterprise-level coverage.

Changes:

  • Include a new NegotiateAuthenticationTest.cs in the Enterprise test project.
  • Add several client-only and client/server NegotiateAuthentication handshake tests (including protection level and wrap/unwrap scenarios).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 12 comments.

File Description
src/libraries/System.Net.Security/tests/EnterpriseTests/System.Net.Security.Enterprise.Tests.csproj Adds the new NegotiateAuthentication Enterprise test file to the test project.
src/libraries/System.Net.Security/tests/EnterpriseTests/NegotiateAuthenticationTest.cs Introduces new enterprise tests for NegotiateAuthentication client/server scenarios against a KDC.

Copy link
Copy Markdown
Member

@rzikm rzikm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM if tests pass

@psmulovics
Copy link
Copy Markdown

psmulovics commented Apr 8, 2026

This would be missing edge cases when you also have a realm. Eg HOST/linuxclient.domain.com@realm.io

@wfurt
Copy link
Copy Markdown
Member Author

wfurt commented Apr 8, 2026

This would be missing edge cases when you also have a realm. Eg HOST/linuxclient.domain.com@realm.io

Anything beyond ClientAuthentication_TargetNameWithRealm_Succeeds @psmulovics

@psmulovics
Copy link
Copy Markdown

@fhubi, does that cover all our use cases?

Copilot AI review requested due to automatic review settings April 15, 2026 20:58
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

@wfurt wfurt changed the title Improve NegotiateAuthentication test coverage fix import of SPN with Kerberos realm Apr 16, 2026
@wfurt
Copy link
Copy Markdown
Member Author

wfurt commented Apr 16, 2026

Let me know @filipnavara if this makes sense to you.

Copy link
Copy Markdown
Member

@filipnavara filipnavara left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense to me.

@fhubi
Copy link
Copy Markdown

fhubi commented Apr 17, 2026

@fhubi, does that cover all our use cases?

Probably yes.

Copilot AI review requested due to automatic review settings April 21, 2026 22:21
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

Comment thread src/native/libs/System.Net.Security.Native/pal_gssapi.c
Comment thread src/native/libs/System.Net.Security.Native/pal_gssapi.c
@wfurt
Copy link
Copy Markdown
Member Author

wfurt commented Apr 22, 2026

/ba-g failures unrelated

@wfurt wfurt merged commit 038da9e into dotnet:main Apr 22, 2026
103 of 116 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SPN with Kerberos realm do not work with NegotiateAuthentication

6 participants