{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/corefx/issues/29941","repository_url":"https://api.github.com/repos/dotnet/corefx","labels_url":"https://api.github.com/repos/dotnet/corefx/issues/29941/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/corefx/issues/29941/comments","events_url":"https://api.github.com/repos/dotnet/corefx/issues/29941/events","html_url":"https://github.com/dotnet/corefx/issues/29941","id":326935547,"node_id":"MDU6SXNzdWUzMjY5MzU1NDc=","number":29941,"title":"SPNEGO logon fails from linux client against windows server","user":{"login":"Aarthiumayaval","id":30315678,"node_id":"MDQ6VXNlcjMwMzE1Njc4","avatar_url":"https://avatars3.githubusercontent.com/u/30315678?v=4","gravatar_id":"","url":"https://api.github.com/users/Aarthiumayaval","html_url":"https://github.com/Aarthiumayaval","followers_url":"https://api.github.com/users/Aarthiumayaval/followers","following_url":"https://api.github.com/users/Aarthiumayaval/following{/other_user}","gists_url":"https://api.github.com/users/Aarthiumayaval/gists{/gist_id}","starred_url":"https://api.github.com/users/Aarthiumayaval/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Aarthiumayaval/subscriptions","organizations_url":"https://api.github.com/users/Aarthiumayaval/orgs","repos_url":"https://api.github.com/users/Aarthiumayaval/repos","events_url":"https://api.github.com/users/Aarthiumayaval/events{/privacy}","received_events_url":"https://api.github.com/users/Aarthiumayaval/received_events","type":"User","site_admin":false},"labels":[{"id":497898777,"node_id":"MDU6TGFiZWw0OTc4OTg3Nzc=","url":"https://api.github.com/repos/dotnet/corefx/labels/area-System.Net.Security","name":"area-System.Net.Security","color":"d4c5f9","default":false},{"id":145399955,"node_id":"MDU6TGFiZWwxNDUzOTk5NTU=","url":"https://api.github.com/repos/dotnet/corefx/labels/bug","name":"bug","color":"207de5","default":true},{"id":205613977,"node_id":"MDU6TGFiZWwyMDU2MTM5Nzc=","url":"https://api.github.com/repos/dotnet/corefx/labels/os-linux","name":"os-linux","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/dotnet/corefx/milestones/21","html_url":"https://github.com/dotnet/corefx/milestone/21","labels_url":"https://api.github.com/repos/dotnet/corefx/milestones/21/labels","id":3242632,"node_id":"MDk6TWlsZXN0b25lMzI0MjYzMg==","number":21,"title":"3.0","description":".NET Core 3.0, next major release after 2.1. See [official release dates](https://github.com/dotnet/core/blob/master/roadmap.md) for details.\r\n\r\nWe will move important issues from Future to 3.0 as the priorities and dates for next release become more clear.","creator":{"login":"karelz","id":5776068,"node_id":"MDQ6VXNlcjU3NzYwNjg=","avatar_url":"https://avatars2.githubusercontent.com/u/5776068?v=4","gravatar_id":"","url":"https://api.github.com/users/karelz","html_url":"https://github.com/karelz","followers_url":"https://api.github.com/users/karelz/followers","following_url":"https://api.github.com/users/karelz/following{/other_user}","gists_url":"https://api.github.com/users/karelz/gists{/gist_id}","starred_url":"https://api.github.com/users/karelz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/karelz/subscriptions","organizations_url":"https://api.github.com/users/karelz/orgs","repos_url":"https://api.github.com/users/karelz/repos","events_url":"https://api.github.com/users/karelz/events{/privacy}","received_events_url":"https://api.github.com/users/karelz/received_events","type":"User","site_admin":false},"open_issues":170,"closed_issues":702,"state":"open","created_at":"2018-04-04T16:40:10Z","updated_at":"2018-06-07T21:36:01Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2018-05-28T08:05:46Z","updated_at":"2018-06-07T21:41:49Z","closed_at":null,"author_association":"NONE","body":"Attaching  client and server application compiled in netcoreapp2.0 . Authentication is successful from windows client and failed from linux client. The server is windows . In the client code I used impersonation level as System.Security.Principal.TokenImpersonationLevel.Identification for linux as this is only supported. From windows I used System.Security.Principal.TokenImpersonationLevel.Impersponation\r\n\r\nFrom linux client , I see the below error\r\n[root@sdl17146 publish]# dotnet krbclient.dll\r\n\r\n```\r\nUnhandled Exception: System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: GSSAPI operation failed with error - An invalid status code was supplied (Message stream modified).\r\n   --- End of inner exception stack trace ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Net.Security.NegoState.StartSendAuthResetSignal(LazyAsyncResult lazyResult, Byte[] message, Exception exception)\r\n   at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult)\r\n   at System.Net.Security.NegoState.CheckCompletionBeforeNextSend(Byte[] message, LazyAsyncResult lazyResult)\r\n   at System.Net.Security.NegoState.ProcessReceivedBlob(Byte[] message, LazyAsyncResult lazyResult)\r\n   at System.Net.Security.NegoState.StartReceiveBlob(LazyAsyncResult lazyResult)\r\n   at System.Net.Security.NegoState.CheckCompletionBeforeNextReceive(LazyAsyncResult lazyResult)\r\n   at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult)\r\n   at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult)\r\n   at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, ChannelBinding binding, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel)\r\n   at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel)\r\n   at krbclient.ASynchronousAuthenticatingTcpClient.Main(String[] args)\r\nAborted (core dumped)\r\n```\r\n\r\nFrom windows client:\r\n-------------------------\r\nC:\\Users\\rl151007.ESROOTDOM\\aarthi>krbclient.exe\r\nClient waiting for authentication...\r\nIsAuthenticated: True\r\nIsMutuallyAuthenticated: False\r\nIsEncrypted: True\r\nIsSigned: True\r\nIsServer: False\r\nSent 22 bytes.\r\nClient closed.\r\nkrbclient.cs\r\n\r\n```c#\r\nusing System;\r\nusing System.IO;\r\nusing System.Net;\r\nusing System.Net.Security;\r\nusing System.Net.Sockets;\r\nusing System.Text;\r\n\r\nnamespace krbclient\r\n{\r\n    public class ASynchronousAuthenticatingTcpClient\r\n    {\r\n        static TcpClient client = null;\r\n\r\n        public static void Main(String[] args)\r\n        {\r\n            // Establish the remote endpoint for the socket.\r\n            // For this example, use the local machine.\r\n            //IPHostEntry ipHostInfo = Dns.GetHostEntry(\"localhost\");\r\n            //IPAddress ipAddress = ipHostInfo.AddressList[0];\r\n            // Client and server use port 11000. \r\n            //IPEndPoint remoteEP = new IPEndPoint(ipAddress, 11000);\r\n            // Create a TCP/IP socket.\r\n            client = new TcpClient();\r\n            // Connect the socket to the remote endpoint.\r\n            client.Connect(\"esroot\", 9999);\r\n            //Console.WriteLine(\"Client connected to {0}.\", remoteEP.ToString());\r\n            // Ensure the client does not close when there is \r\n            // still data to be sent to the server.\r\n            client.LingerState = (new LingerOption(true, 0));\r\n\r\n            System.Security.Principal.TokenImpersonationLevel impLevel = System.Security.Principal.TokenImpersonationLevel.Identification;\r\n                \r\n             // Request authentication.\r\n             NetworkStream clientStream = client.GetStream();\r\n            NegotiateStream authStream = new NegotiateStream(clientStream, false);\r\n            // Pass the NegotiateStream as the AsyncState object \r\n            // so that it is available to the callback delegate.\r\n            /*  IAsyncResult ar = authStream.BeginAuthenticateAsClient(\r\n                  new AsyncCallback(EndAuthenticateCallback),\r\n                  authStream\r\n                  );*/\r\n            //NetworkCredential cred = new NetworkCredential(\"au185009\", \"@Thirukami9876\");\r\n            authStream.AuthenticateAsClient(CredentialCache.DefaultNetworkCredentials, \"HOST/ESROOT\",\r\n       ProtectionLevel.EncryptAndSign,\r\n       impLevel);\r\n\r\n            StreamWriter writer = new StreamWriter(authStream);\r\n            Console.WriteLine(\"Client waiting for authentication...\");\r\n            // Wait until the result is available.\r\n            //ar.AsyncWaitHandle.WaitOne();\r\n            // Display the properties of the authenticated stream.\r\n            AuthenticatedStreamReporter.DisplayProperties(authStream);\r\n            // Send a message to the server.\r\n            // Encode the test data into a byte array.\r\n            byte[] message = Encoding.UTF8.GetBytes(\"Hello from the client.\");\r\n            //ar = authStream.BeginWrite(message, 0, message.Length,\r\n              //  new AsyncCallback(EndWriteCallback),\r\n              //  authStream);\r\n            //ar.AsyncWaitHandle.WaitOne();\r\n            authStream.Write(message, 0, message.Length);\r\n\r\n\r\n            Console.WriteLine(\"Sent {0} bytes.\", message.Length);\r\n            // Close the client connection.\r\n            authStream.Close();\r\n            Console.WriteLine(\"Client closed.\");\r\n        }\r\n        // The following method is called when the authentication completes.\r\n        public static void EndAuthenticateCallback(IAsyncResult ar)\r\n        {\r\n            Console.WriteLine(\"Client ending authentication...\");\r\n            NegotiateStream authStream = (NegotiateStream)ar.AsyncState;\r\n            Console.WriteLine(\"ImpersonationLevel: {0}\", authStream.ImpersonationLevel);\r\n\r\n            // End the asynchronous operation.\r\n            authStream.EndAuthenticateAsClient(ar);\r\n        }\r\n        // The following method is called when the write operation completes.\r\n        public static void EndWriteCallback(IAsyncResult ar)\r\n        {\r\n            Console.WriteLine(\"Client ending write operation...\");\r\n            NegotiateStream authStream = (NegotiateStream)ar.AsyncState;\r\n\r\n            // End the asynchronous operation.\r\n            authStream.EndWrite(ar);\r\n        }\r\n    }\r\n\r\n    // The following class displays the properties of an authenticatedStream.\r\n    public class AuthenticatedStreamReporter\r\n    {\r\n        public static void DisplayProperties(AuthenticatedStream stream)\r\n        {\r\n            Console.WriteLine(\"IsAuthenticated: {0}\", stream.IsAuthenticated);\r\n            Console.WriteLine(\"IsMutuallyAuthenticated: {0}\", stream.IsMutuallyAuthenticated);\r\n            Console.WriteLine(\"IsEncrypted: {0}\", stream.IsEncrypted);\r\n            Console.WriteLine(\"IsSigned: {0}\", stream.IsSigned);\r\n            Console.WriteLine(\"IsServer: {0}\", stream.IsServer);\r\n        }\r\n    }\r\n}\r\n```\r\n\r\nkrbserver.cs\r\n\r\n```c#\r\nusing System;\r\nusing System.Net;\r\nusing System.Net.Security;\r\nusing System.Net.Sockets;\r\nusing System.Security.Authentication;\r\nusing System.Security.Principal;\r\nusing System.Text;\r\nusing System.Threading;\r\n\r\nnamespace krbserver\r\n{\r\n\r\n        public class Program\r\n        {\r\n            public static void Main()\r\n            {\r\n                // Create an IPv4 TCP/IP socket. \r\n                TcpListener listener = new TcpListener(IPAddress.Any, 9999);\r\n                // Listen for incoming connections.\r\n                listener.Start();\r\n                while (true)\r\n                {\r\n                    TcpClient clientRequest = null;\r\n                    // Application blocks while waiting for an incoming connection.\r\n                    // Type CNTL-C to terminate the server.\r\n                    clientRequest = listener.AcceptTcpClient();\r\n                    Console.WriteLine(\"Client connected.\");\r\n                    // A client has connected. \r\n                    try\r\n                    {\r\n                        AuthenticateClient(clientRequest);\r\n                    }\r\n                    catch (Exception e)\r\n                    {\r\n                        Console.WriteLine(e);\r\n                        continue;\r\n                    }\r\n\r\n                }\r\n\r\n            }\r\n            public static void AuthenticateClient(TcpClient clientRequest)\r\n            {\r\n                NetworkStream stream = clientRequest.GetStream();\r\n                // Create the NegotiateStream.\r\n                NegotiateStream authStream = new NegotiateStream(stream, false);\r\n                // Save the current client and NegotiateStream instance \r\n                // in a ClientState object.\r\n                ClientState cState = new ClientState(authStream, clientRequest);\r\n                /* Listen for the client authentication request.\r\n                authStream.BeginAuthenticateAsServer(\r\n                    new AsyncCallback(EndAuthenticateCallback),\r\n                    cState\r\n                    );*/\r\n\r\n            authStream.AuthenticateAsServer(CredentialCache.DefaultNetworkCredentials,\r\n      ProtectionLevel.EncryptAndSign,\r\n      TokenImpersonationLevel.Impersonation);\r\n\r\n            Console.WriteLine(\"Client Identity\", authStream.ToString());\r\n            // Wait until the authentication completes.\r\n            cState.Waiter.WaitOne();\r\n                cState.Waiter.Reset();\r\n                authStream.BeginRead(cState.Buffer, 0, cState.Buffer.Length,\r\n                       new AsyncCallback(EndReadCallback),\r\n                       cState);\r\n                cState.Waiter.WaitOne();\r\n                // Finished with the current client.\r\n                authStream.Close();\r\n                clientRequest.Close();\r\n            }\r\n            // The following method is invoked by the\r\n            // BeginAuthenticateAsServer callback delegate.\r\n\r\n            public static void EndAuthenticateCallback(IAsyncResult ar)\r\n            {\r\n                // Get the saved data.\r\n                ClientState cState = (ClientState)ar.AsyncState;\r\n                TcpClient clientRequest = cState.Client;\r\n                NegotiateStream authStream = (NegotiateStream)cState.AuthenticatedStream;\r\n                Console.WriteLine(\"Ending authentication.\");\r\n                // Any exceptions that occurred during authentication are\r\n                // thrown by the EndAuthenticateAsServer method.\r\n                try\r\n                {\r\n                    // This call blocks until the authentication is complete.\r\n                    authStream.EndAuthenticateAsServer(ar);\r\n                }\r\n                catch (AuthenticationException e)\r\n                {\r\n                    Console.WriteLine(e);\r\n                    Console.WriteLine(\"Authentication failed - closing connection.\");\r\n                    cState.Waiter.Set();\r\n                    return;\r\n                }\r\n                catch (Exception e)\r\n                {\r\n                    Console.WriteLine(e);\r\n                    Console.WriteLine(\"Closing connection.\");\r\n                    cState.Waiter.Set();\r\n                    return;\r\n                }\r\n                // Display properties of the authenticated client.\r\n                IIdentity id = authStream.RemoteIdentity;\r\n                Console.WriteLine(\"{0} was authenticated using {1}.\",\r\n                    id.Name,\r\n                    id.AuthenticationType\r\n                    );\r\n                cState.Waiter.Set();\r\n\r\n            }\r\n            public static void EndReadCallback(IAsyncResult ar)\r\n            {\r\n                // Get the saved data.\r\n                ClientState cState = (ClientState)ar.AsyncState;\r\n                TcpClient clientRequest = cState.Client;\r\n                NegotiateStream authStream = (NegotiateStream)cState.AuthenticatedStream;\r\n                // Get the buffer that stores the message sent by the client.\r\n                int bytes = -1;\r\n                // Read the client message.\r\n                try\r\n                {\r\n                    bytes = authStream.EndRead(ar);\r\n                    cState.Message.Append(Encoding.UTF8.GetChars(cState.Buffer, 0, bytes));\r\n                    if (bytes != 0)\r\n                    {\r\n                        authStream.BeginRead(cState.Buffer, 0, cState.Buffer.Length,\r\n                              new AsyncCallback(EndReadCallback),\r\n                              cState);\r\n                        return;\r\n                    }\r\n                }\r\n                catch (Exception e)\r\n                {\r\n                    // A real application should do something\r\n                    // useful here, such as logging the failure.\r\n                    Console.WriteLine(\"Client message exception:\");\r\n                    Console.WriteLine(e);\r\n                    cState.Waiter.Set();\r\n                    return;\r\n                }\r\n                IIdentity id = authStream.RemoteIdentity;\r\n                Console.WriteLine(\"{0} says {1}\", id.Name, cState.Message.ToString());\r\n                cState.Waiter.Set();\r\n            }\r\n        }\r\n        // ClientState is the AsyncState object.\r\n        internal class ClientState\r\n        {\r\n            private AuthenticatedStream authStream = null;\r\n            private TcpClient client = null;\r\n            byte[] buffer = new byte[2048];\r\n            StringBuilder message = null;\r\n            ManualResetEvent waiter = new ManualResetEvent(false);\r\n            internal ClientState(AuthenticatedStream a, TcpClient theClient)\r\n            {\r\n                authStream = a;\r\n                client = theClient;\r\n            }\r\n            internal TcpClient Client\r\n            {\r\n                get { return client; }\r\n            }\r\n            internal AuthenticatedStream AuthenticatedStream\r\n            {\r\n                get { return authStream; }\r\n            }\r\n            internal byte[] Buffer\r\n            {\r\n                get { return buffer; }\r\n            }\r\n            internal StringBuilder Message\r\n            {\r\n                get\r\n                {\r\n                    if (message == null)\r\n                        message = new StringBuilder();\r\n                    return message;\r\n                }\r\n            }\r\n            internal ManualResetEvent Waiter\r\n            {\r\n                get\r\n                {\r\n                    return waiter;\r\n                }\r\n            }\r\n        }\r\n    \r\n}\r\n```\r\n\r\n[EDIT] Fixing code and exception formatting by @karelz"},"comment":{"url":"https://api.github.com/repos/dotnet/corefx/issues/comments/395574598","html_url":"https://github.com/dotnet/corefx/issues/29941#issuecomment-395574598","issue_url":"https://api.github.com/repos/dotnet/corefx/issues/29941","id":395574598,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NTU3NDU5OA==","user":{"login":"karelz","id":5776068,"node_id":"MDQ6VXNlcjU3NzYwNjg=","avatar_url":"https://avatars2.githubusercontent.com/u/5776068?v=4","gravatar_id":"","url":"https://api.github.com/users/karelz","html_url":"https://github.com/karelz","followers_url":"https://api.github.com/users/karelz/followers","following_url":"https://api.github.com/users/karelz/following{/other_user}","gists_url":"https://api.github.com/users/karelz/gists{/gist_id}","starred_url":"https://api.github.com/users/karelz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/karelz/subscriptions","organizations_url":"https://api.github.com/users/karelz/orgs","repos_url":"https://api.github.com/users/karelz/repos","events_url":"https://api.github.com/users/karelz/events{/privacy}","received_events_url":"https://api.github.com/users/karelz/received_events","type":"User","site_admin":false},"created_at":"2018-06-07T21:41:49Z","updated_at":"2018-06-07T21:41:49Z","author_association":"MEMBER","body":"@CalArabshahi it is a good question, but does not seem to be directly related to this issue. Let's not hijack it. Please file a new issue for discussion. @wfurt is the right expert.\r\nIn nutshell: Networking APIs in 2.1 support Kerberos. For SqlClient question we will likely need separate set of experts from the area to answer."}}
{"actor":{"display_login":"karelz"}}