{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/corefx/issues/6767","repository_url":"https://api.github.com/repos/dotnet/corefx","labels_url":"https://api.github.com/repos/dotnet/corefx/issues/6767/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/corefx/issues/6767/comments","events_url":"https://api.github.com/repos/dotnet/corefx/issues/6767/events","html_url":"https://github.com/dotnet/corefx/issues/6767","id":139480961,"number":6767,"title":"NegotiateStream.Write interop issues on Linux/OSX","user":{"login":"vijaykota","id":11638339,"avatar_url":"https://avatars.githubusercontent.com/u/11638339?v=3","gravatar_id":"","url":"https://api.github.com/users/vijaykota","html_url":"https://github.com/vijaykota","followers_url":"https://api.github.com/users/vijaykota/followers","following_url":"https://api.github.com/users/vijaykota/following{/other_user}","gists_url":"https://api.github.com/users/vijaykota/gists{/gist_id}","starred_url":"https://api.github.com/users/vijaykota/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vijaykota/subscriptions","organizations_url":"https://api.github.com/users/vijaykota/orgs","repos_url":"https://api.github.com/users/vijaykota/repos","events_url":"https://api.github.com/users/vijaykota/events{/privacy}","received_events_url":"https://api.github.com/users/vijaykota/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"shrutigarg","id":13743289,"avatar_url":"https://avatars.githubusercontent.com/u/13743289?v=3","gravatar_id":"","url":"https://api.github.com/users/shrutigarg","html_url":"https://github.com/shrutigarg","followers_url":"https://api.github.com/users/shrutigarg/followers","following_url":"https://api.github.com/users/shrutigarg/following{/other_user}","gists_url":"https://api.github.com/users/shrutigarg/gists{/gist_id}","starred_url":"https://api.github.com/users/shrutigarg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shrutigarg/subscriptions","organizations_url":"https://api.github.com/users/shrutigarg/orgs","repos_url":"https://api.github.com/users/shrutigarg/repos","events_url":"https://api.github.com/users/shrutigarg/events{/privacy}","received_events_url":"https://api.github.com/users/shrutigarg/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/dotnet/corefx/milestones/4","html_url":"https://github.com/dotnet/corefx/milestones/1.0.0-rtm","labels_url":"https://api.github.com/repos/dotnet/corefx/milestones/4/labels","id":1248719,"number":4,"title":"1.0.0-rtm","description":"2016 https://github.com/aspnet/Home/wiki/Roadmap","creator":{"login":"joshfree","id":1302850,"avatar_url":"https://avatars.githubusercontent.com/u/1302850?v=3","gravatar_id":"","url":"https://api.github.com/users/joshfree","html_url":"https://github.com/joshfree","followers_url":"https://api.github.com/users/joshfree/followers","following_url":"https://api.github.com/users/joshfree/following{/other_user}","gists_url":"https://api.github.com/users/joshfree/gists{/gist_id}","starred_url":"https://api.github.com/users/joshfree/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshfree/subscriptions","organizations_url":"https://api.github.com/users/joshfree/orgs","repos_url":"https://api.github.com/users/joshfree/repos","events_url":"https://api.github.com/users/joshfree/events{/privacy}","received_events_url":"https://api.github.com/users/joshfree/received_events","type":"User","site_admin":false},"open_issues":330,"closed_issues":342,"state":"open","created_at":"2015-08-10T18:04:00Z","updated_at":"2016-03-09T05:39:07Z","due_on":"2016-06-30T07:00:00Z","closed_at":null},"comments":1,"created_at":"2016-03-09T05:39:07Z","updated_at":"2016-03-09T05:54:24Z","closed_at":null,"body":"There are some combinations of Kerberos/NTLM, SignOnly/EncryptAndSign etc. that cause the ```gss_wrap``` call on Unix client to fail against a Windows server using ```NegotiateStream```. This issue is for tracking the foll. failing combinations of credentials and protection level passed in ```AuthenticateAsClientAsync```\r\n\r\nOn Linux:\r\n````\r\nKerberos creds with Sign: Server complains that signature is valid but contents not encrypted\r\nNTLM creds with EncrypAndSign: Server rejects signature\r\nNTLM creds with Sign: Server rejects signature\r\n````\r\n\r\nOn OSX:\r\n````\r\nKerberos creds with Sign: Server complains that signature is valid but contents not encrypted\r\nNTLM creds with EncryptAndSign: Server complains about message format\r\nNTLM creds with Sign: gss_wrap fails on client side\r\n````"},"comment":{"url":"https://api.github.com/repos/dotnet/corefx/issues/comments/194126245","html_url":"https://github.com/dotnet/corefx/issues/6767#issuecomment-194126245","issue_url":"https://api.github.com/repos/dotnet/corefx/issues/6767","id":194126245,"user":{"login":"vijaykota","id":11638339,"avatar_url":"https://avatars.githubusercontent.com/u/11638339?v=3","gravatar_id":"","url":"https://api.github.com/users/vijaykota","html_url":"https://github.com/vijaykota","followers_url":"https://api.github.com/users/vijaykota/followers","following_url":"https://api.github.com/users/vijaykota/following{/other_user}","gists_url":"https://api.github.com/users/vijaykota/gists{/gist_id}","starred_url":"https://api.github.com/users/vijaykota/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vijaykota/subscriptions","organizations_url":"https://api.github.com/users/vijaykota/orgs","repos_url":"https://api.github.com/users/vijaykota/repos","events_url":"https://api.github.com/users/vijaykota/events{/privacy}","received_events_url":"https://api.github.com/users/vijaykota/received_events","type":"User","site_admin":false},"created_at":"2016-03-09T05:54:24Z","updated_at":"2016-03-09T05:54:24Z","body":"For Linux, we are working with RedHat engineers: https://fedorahosted.org/gss-ntlmssp/ticket/8 \r\nPossible issues are:\r\n1. ```gss_wrap``` on client side may not be interoperable with WIndows SSPI ```VerifySignature``` on server side (used via ```NegotiateStream.AuthenticateAsServerAsync```). Reference: https://msdn.microsoft.com/en-us/library/ms995352.aspx\r\n2. Use ```gss_set_cred_options(NO_CI_FLAGS_X_OID)``` introduced in 1.14.x to force MIT client to negotiate integrity only instead of default of confidentiality+integrity. The issue seems to be the flags interpretation in ```gss_init_sec_context``` is not required set like in Windows case.\r\n\r\nFor OSX, trying to find a solution by posting at https://discussions.apple.com/message/29893662#29893662 \r\n"}}