Throw PlatformNotSupportedException on Unix/Managed NegotiateAuthenticationPal implementation for NTLM w/ default credentials.

filipnavara · filipnavara · commit 9e203827bd4f · 2023-08-27T14:10:01.000+02:00
This was handled inconsistently between the managed NTLM implementation and the GSSAPI one.
Add test for the behavior.
Handle PlatformNotSupportedException in SocketsHttpHandler and Managed SPNEGO implementation.
Add test to ensure SocketsHttpHandler using CredentialCache.DefaultCredentials with NTLM doesn't throw PNSE exception and returns the Unauthorized HTTP response instead.
diff --git a/src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/AuthenticationHelper.NtAuth.cs b/src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/AuthenticationHelper.NtAuth.cs
@@ -217,6 +217,12 @@ private static async Task<HttpResponseMessage> SendWithNtAuthAsync(HttpRequestMe
                             needDrain = true;
                         }
                     }
+                    catch (PlatformNotSupportedException)
+                    {
+                        // Ignore PNSE from NegotiateAuthentication with unsupported parameters
+                        // and treat it the same way as if we didn't support the authentication
+                        // in the first place.
+                    }
                     finally
                     {
                         if (isNewConnection)
diff --git a/src/libraries/System.Net.Http/tests/FunctionalTests/NtAuthTests.FakeServer.cs b/src/libraries/System.Net.Http/tests/FunctionalTests/NtAuthTests.FakeServer.cs
@@ -139,5 +139,33 @@ await server.AcceptConnectionAsync(async connection =>
                     }).ConfigureAwait(false);
                 });
         }
+
+        [Fact]
+        [SkipOnPlatform(TestPlatforms.Browser | TestPlatforms.Windows, "DefaultCredentials are unsupported for NTLM on Unix / Managed implementation")]
+        public async Task DefaultHandler_FakeServer_DefaultCredentials()
+        {
+            await LoopbackServer.CreateClientAndServerAsync(
+                async uri =>
+                {
+                    HttpRequestMessage requestMessage = new HttpRequestMessage(HttpMethod.Get, uri);
+                    requestMessage.Version = new Version(1, 1);
+
+                    HttpMessageHandler handler = new HttpClientHandler() { Credentials = CredentialCache.DefaultCredentials };
+                    using (var client = new HttpClient(handler))
+                    {
+                        HttpResponseMessage response = await client.SendAsync(requestMessage);
+                        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+                    }
+                },
+                async server =>
+                {
+                    await server.AcceptConnectionAsync(async connection =>
+                    {
+                        var authHeader = "WWW-Authenticate: NTLM\r\n";
+                        await connection.SendResponseAsync(HttpStatusCode.Unauthorized, authHeader).ConfigureAwait(false);
+                        connection.CompleteRequestProcessing();
+                    }).ConfigureAwait(false);
+                });
+        }
     }
 }
diff --git a/src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.ManagedNtlm.cs b/src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.ManagedNtlm.cs
@@ -222,13 +222,16 @@ public ManagedNtlmNegotiateAuthenticationPal(NegotiateAuthenticationClientOption
             {
                 Debug.Assert(clientOptions.Package == NegotiationInfoClass.NTLM);
 
-                _credential = clientOptions.Credential;
-                if (string.IsNullOrWhiteSpace(_credential.UserName) || string.IsNullOrWhiteSpace(_credential.Password))
+                if (clientOptions.Credential == CredentialCache.DefaultNetworkCredentials ||
+                    string.IsNullOrWhiteSpace(clientOptions.Credential.UserName) ||
+                    string.IsNullOrWhiteSpace(clientOptions.Credential.Password))
                 {
                     // NTLM authentication is not possible with default credentials which are no-op
+                    if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, SR.net_ntlm_not_possible_default_cred);
                     throw new PlatformNotSupportedException(SR.net_ntlm_not_possible_default_cred);
                 }
 
+                _credential = clientOptions.Credential;
                 _spn = clientOptions.TargetName;
                 _channelBinding = clientOptions.Binding;
                 _protectionLevel = clientOptions.RequiredProtectionLevel;
diff --git a/src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.ManagedSpnego.cs b/src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.ManagedSpnego.cs
@@ -115,7 +115,7 @@ public override void Dispose()
 
             private NegotiateAuthenticationPal CreateMechanismForPackage(string packageName)
             {
-                return NegotiateAuthenticationPal.Create(new NegotiateAuthenticationClientOptions
+                var updatedClientOptions = new NegotiateAuthenticationClientOptions
                 {
                     Package = packageName,
                     Credential = _clientOptions.Credential,
@@ -124,7 +124,16 @@ private NegotiateAuthenticationPal CreateMechanismForPackage(string packageName)
                     RequiredProtectionLevel = _clientOptions.RequiredProtectionLevel,
                     RequireMutualAuthentication = _clientOptions.RequireMutualAuthentication,
                     AllowedImpersonationLevel = _clientOptions.AllowedImpersonationLevel,
-                });
+                };
+
+                try
+                {
+                    return NegotiateAuthenticationPal.Create(updatedClientOptions);
+                }
+                catch (PlatformNotSupportedException)
+                {
+                    return new UnsupportedNegotiateAuthenticationPal(updatedClientOptions);
+                }
             }
 
             private IEnumerable<KeyValuePair<string, string>> EnumerateMechanisms()
@@ -303,16 +312,7 @@ private IEnumerable<KeyValuePair<string, string>> EnumerateMechanisms()
                     {
                         // Abandon the optimistic path and restart with a new mechanism
                         _optimisticMechanism?.Dispose();
-                        _mechanism = NegotiateAuthenticationPal.Create(new NegotiateAuthenticationClientOptions
-                        {
-                            Package = requestedPackage,
-                            Credential = _clientOptions.Credential,
-                            TargetName = _clientOptions.TargetName,
-                            Binding = _clientOptions.Binding,
-                            RequiredProtectionLevel = _clientOptions.RequiredProtectionLevel,
-                            RequireMutualAuthentication = _clientOptions.RequireMutualAuthentication,
-                            AllowedImpersonationLevel = _clientOptions.AllowedImpersonationLevel,
-                        });
+                        _mechanism = CreateMechanismForPackage(requestedPackage);
                     }
 
                     _optimisticMechanism = null;
diff --git a/src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unix.cs b/src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unix.cs
@@ -42,13 +42,15 @@ public static NegotiateAuthenticationPal Create(NegotiateAuthenticationClientOpt
             {
                 return new UnixNegotiateAuthenticationPal(clientOptions);
             }
-            catch (Win32Exception)
+            catch (Interop.NetSecurityNative.GssApiException gex)
             {
-                return new UnsupportedNegotiateAuthenticationPal(clientOptions);
-            }
-            catch (PlatformNotSupportedException)
-            {
-                return new UnsupportedNegotiateAuthenticationPal(clientOptions);
+                if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(null, gex);
+                NegotiateAuthenticationStatusCode statusCode = UnixNegotiateAuthenticationPal.GetErrorCode(gex);
+                if (statusCode <= NegotiateAuthenticationStatusCode.GenericFailure)
+                {
+                    statusCode = NegotiateAuthenticationStatusCode.Unsupported;
+                }
+                return new UnsupportedNegotiateAuthenticationPal(clientOptions, statusCode);
             }
             catch (EntryPointNotFoundException)
             {
@@ -63,13 +65,15 @@ public static NegotiateAuthenticationPal Create(NegotiateAuthenticationServerOpt
             {
                 return new UnixNegotiateAuthenticationPal(serverOptions);
             }
-            catch (Win32Exception)
+            catch (Interop.NetSecurityNative.GssApiException gex)
             {
-                return new UnsupportedNegotiateAuthenticationPal(serverOptions);
-            }
-            catch (PlatformNotSupportedException)
-            {
-                return new UnsupportedNegotiateAuthenticationPal(serverOptions);
+                if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(null, gex);
+                NegotiateAuthenticationStatusCode statusCode = UnixNegotiateAuthenticationPal.GetErrorCode(gex);
+                if (statusCode <= NegotiateAuthenticationStatusCode.GenericFailure)
+                {
+                    statusCode = NegotiateAuthenticationStatusCode.Unsupported;
+                }
+                return new UnsupportedNegotiateAuthenticationPal(serverOptions, statusCode);
             }
             catch (EntryPointNotFoundException)
             {
@@ -184,22 +188,25 @@ public UnixNegotiateAuthenticationPal(NegotiateAuthenticationClientOptions clien
 
                 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"Peer SPN-> '{_spn}'");
 
-                if (clientOptions.Credential == CredentialCache.DefaultCredentials ||
+                if (clientOptions.Credential == CredentialCache.DefaultNetworkCredentials ||
                     string.IsNullOrWhiteSpace(clientOptions.Credential.UserName) ||
                     string.IsNullOrWhiteSpace(clientOptions.Credential.Password))
                 {
                     if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, "using DefaultCredentials");
-                    _credentialsHandle = AcquireDefaultCredential();
 
                     if (_packageType == Interop.NetSecurityNative.PackageType.NTLM)
                     {
                         // NTLM authentication is not possible with default credentials which are no-op
+                        if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, SR.net_ntlm_not_possible_default_cred);
                         throw new PlatformNotSupportedException(SR.net_ntlm_not_possible_default_cred);
                     }
                     if (string.IsNullOrEmpty(_spn))
                     {
+                        if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, SR.net_nego_not_supported_empty_target_with_defaultcreds);
                         throw new PlatformNotSupportedException(SR.net_nego_not_supported_empty_target_with_defaultcreds);
                     }
+
+                    _credentialsHandle = SafeGssCredHandle.Create(string.Empty, string.Empty, _packageType);
                 }
                 else
                 {
@@ -229,7 +236,7 @@ public UnixNegotiateAuthenticationPal(NegotiateAuthenticationServerOptions serve
 
                 if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"Peer SPN-> '{_spn}'");
 
-                if (serverOptions.Credential == CredentialCache.DefaultCredentials ||
+                if (serverOptions.Credential == CredentialCache.DefaultNetworkCredentials ||
                     string.IsNullOrWhiteSpace(serverOptions.Credential.UserName) ||
                     string.IsNullOrWhiteSpace(serverOptions.Credential.Password))
                 {
@@ -462,24 +469,7 @@ private static Interop.NetSecurityNative.PackageType GetPackageType(string packa
                 else
                 {
                     // Native shim currently supports only NTLM, Negotiate and Kerberos
-                    throw new PlatformNotSupportedException(SR.net_securitypackagesupport);
-                }
-            }
-
-            private SafeGssCredHandle AcquireDefaultCredential()
-            {
-                try
-                {
-                    return SafeGssCredHandle.Create(string.Empty, string.Empty, _packageType);
-                }
-                catch (Exception ex)
-                {
-                    if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(this, ex);
-
-                    // NOTE: We throw PlatformNotSupportedException which is caught in
-                    // NegotiateAuthenticationPal.Create and transformed into instantiation of
-                    // UnsupportedNegotiateAuthenticationPal.
-                    throw new PlatformNotSupportedException(ex.Message, ex);
+                    throw new Interop.NetSecurityNative.GssApiException(Interop.NetSecurityNative.Status.GSS_S_UNAVAILABLE, 0);
                 }
             }
 
@@ -511,14 +501,10 @@ private SafeGssCredHandle AcquireCredentialsHandle(NetworkCredential credential)
 
                     return SafeGssCredHandle.Create(username, password, _packageType);
                 }
-                catch (Exception ex)
+                catch (Exception ex) when (ex is not Interop.NetSecurityNative.GssApiException)
                 {
                     if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(this, ex);
-
-                    // NOTE: We throw PlatformNotSupportedException which is caught in
-                    // NegotiateAuthenticationPal.Create and transformed into instantiation of
-                    // UnsupportedNegotiateAuthenticationPal.
-                    throw new PlatformNotSupportedException(ex.Message, ex);
+                    throw new Interop.NetSecurityNative.GssApiException(Interop.NetSecurityNative.Status.GSS_S_BAD_NAME, 0);
                 }
             }
 
@@ -753,7 +739,7 @@ private NegotiateAuthenticationStatusCode AcceptSecurityContext(
             }
 
             // https://www.gnu.org/software/gss/reference/gss.pdf (page 25)
-            private static NegotiateAuthenticationStatusCode GetErrorCode(Interop.NetSecurityNative.GssApiException exception)
+            internal static NegotiateAuthenticationStatusCode GetErrorCode(Interop.NetSecurityNative.GssApiException exception)
             {
                 switch (exception.MajorStatus)
                 {
diff --git a/src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unsupported.cs b/src/libraries/System.Net.Security/src/System/Net/NegotiateAuthenticationPal.Unsupported.cs
@@ -15,6 +15,7 @@ internal sealed class UnsupportedNegotiateAuthenticationPal : NegotiateAuthentic
         {
             private string _package;
             private string? _targetName;
+            private NegotiateAuthenticationStatusCode _statusCode;
 
             public override bool IsAuthenticated => false;
             public override bool IsSigned => false;
@@ -25,15 +26,17 @@ internal sealed class UnsupportedNegotiateAuthenticationPal : NegotiateAuthentic
             public override IIdentity RemoteIdentity => throw new InvalidOperationException();
             public override System.Security.Principal.TokenImpersonationLevel ImpersonationLevel => System.Security.Principal.TokenImpersonationLevel.Impersonation;
 
-            public UnsupportedNegotiateAuthenticationPal(NegotiateAuthenticationClientOptions clientOptions)
+            public UnsupportedNegotiateAuthenticationPal(NegotiateAuthenticationClientOptions clientOptions, NegotiateAuthenticationStatusCode statusCode = NegotiateAuthenticationStatusCode.Unsupported)
             {
                 _package = clientOptions.Package;
                 _targetName = clientOptions.TargetName;
+                _statusCode = statusCode;
             }
 
-            public UnsupportedNegotiateAuthenticationPal(NegotiateAuthenticationServerOptions serverOptions)
+            public UnsupportedNegotiateAuthenticationPal(NegotiateAuthenticationServerOptions serverOptions, NegotiateAuthenticationStatusCode statusCode = NegotiateAuthenticationStatusCode.Unsupported)
             {
                 _package = serverOptions.Package;
+                _statusCode = statusCode;
             }
 
             public override void Dispose()
@@ -42,7 +45,7 @@ public override void Dispose()
 
             public override byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, out NegotiateAuthenticationStatusCode statusCode)
             {
-                statusCode = NegotiateAuthenticationStatusCode.Unsupported;
+                statusCode = _statusCode;
                 return null;
             }
 
diff --git a/src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs b/src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs
@@ -94,6 +94,14 @@ public void Package_Unsupported_NTLM()
             Assert.Equal(NegotiateAuthenticationStatusCode.Unsupported, statusCode);
         }
 
+        [Fact]
+        [SkipOnPlatform(TestPlatforms.Windows, "The test is specific to GSSAPI / Managed implementations of NegotiateAuthentication")]
+        public void DefaultNetworkCredentials_NTLM_Throws()
+        {
+            NegotiateAuthenticationClientOptions clientOptions = new NegotiateAuthenticationClientOptions { Package = "NTLM", Credential = CredentialCache.DefaultNetworkCredentials, TargetName = "HTTP/foo" };
+            Assert.Throws<PlatformNotSupportedException>(() => new NegotiateAuthentication(clientOptions));
+        }
+
         [Fact]
         public void NtlmProtocolExampleTest()
         {

Original file line number	Diff line number	Diff line change
`@@ -217,6 +217,12 @@ private static async Task<HttpResponseMessage> SendWithNtAuthAsync(HttpRequestMe`
`217`	`217`	`needDrain = true;`
`218`	`218`	`}`
`219`	`219`	`}`
	`220`	`+ catch (PlatformNotSupportedException)`
	`221`	`+ {`
	`222`	`+ // Ignore PNSE from NegotiateAuthentication with unsupported parameters`
	`223`	`+ // and treat it the same way as if we didn't support the authentication`
	`224`	`+ // in the first place.`
	`225`	`+ }`
`220`	`226`	`finally`
`221`	`227`	`{`
`222`	`228`	`if (isNewConnection)`
Original file line number	Diff line number	Diff line change
`@@ -222,13 +222,16 @@ public ManagedNtlmNegotiateAuthenticationPal(NegotiateAuthenticationClientOption`
`222`	`222`	`{`
`223`	`223`	`Debug.Assert(clientOptions.Package == NegotiationInfoClass.NTLM);`
`224`	`224`
`225`		`- _credential = clientOptions.Credential;`
`226`		`- if (string.IsNullOrWhiteSpace(_credential.UserName) \|\| string.IsNullOrWhiteSpace(_credential.Password))`
	`225`	`+ if (clientOptions.Credential == CredentialCache.DefaultNetworkCredentials \|\|`
	`226`	`+ string.IsNullOrWhiteSpace(clientOptions.Credential.UserName) \|\|`
	`227`	`+ string.IsNullOrWhiteSpace(clientOptions.Credential.Password))`
`227`	`228`	`{`
`228`	`229`	`// NTLM authentication is not possible with default credentials which are no-op`
	`230`	`+ if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(null, SR.net_ntlm_not_possible_default_cred);`
`229`	`231`	`throw new PlatformNotSupportedException(SR.net_ntlm_not_possible_default_cred);`
`230`	`232`	`}`
`231`	`233`
	`234`	`+ _credential = clientOptions.Credential;`
`232`	`235`	`_spn = clientOptions.TargetName;`
`233`	`236`	`_channelBinding = clientOptions.Binding;`
`234`	`237`	`_protectionLevel = clientOptions.RequiredProtectionLevel;`
Original file line number	Diff line number	Diff line change
`@@ -42,13 +42,15 @@ public static NegotiateAuthenticationPal Create(NegotiateAuthenticationClientOpt`
`42`	`42`	`{`
`43`	`43`	`return new UnixNegotiateAuthenticationPal(clientOptions);`
`44`	`44`	`}`
`45`		`- catch (Win32Exception)`
	`45`	`+ catch (Interop.NetSecurityNative.GssApiException gex)`
`46`	`46`	`{`
`47`		`- return new UnsupportedNegotiateAuthenticationPal(clientOptions);`
`48`		`- }`
`49`		`- catch (PlatformNotSupportedException)`
`50`		`- {`
`51`		`- return new UnsupportedNegotiateAuthenticationPal(clientOptions);`
	`47`	`+ if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(null, gex);`
	`48`	`+ NegotiateAuthenticationStatusCode statusCode = UnixNegotiateAuthenticationPal.GetErrorCode(gex);`
	`49`	`+ if (statusCode <= NegotiateAuthenticationStatusCode.GenericFailure)`
	`50`	`+ {`
	`51`	`+ statusCode = NegotiateAuthenticationStatusCode.Unsupported;`
	`52`	`+ }`
	`53`	`+ return new UnsupportedNegotiateAuthenticationPal(clientOptions, statusCode);`
`52`	`54`	`}`
`53`	`55`	`catch (EntryPointNotFoundException)`
`54`	`56`	`{`
`@@ -63,13 +65,15 @@ public static NegotiateAuthenticationPal Create(NegotiateAuthenticationServerOpt`
`63`	`65`	`{`
`64`	`66`	`return new UnixNegotiateAuthenticationPal(serverOptions);`
`65`	`67`	`}`
`66`		`- catch (Win32Exception)`
	`68`	`+ catch (Interop.NetSecurityNative.GssApiException gex)`
`67`	`69`	`{`
`68`		`- return new UnsupportedNegotiateAuthenticationPal(serverOptions);`
`69`		`- }`
`70`		`- catch (PlatformNotSupportedException)`
`71`		`- {`
`72`		`- return new UnsupportedNegotiateAuthenticationPal(serverOptions);`
	`70`	`+ if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(null, gex);`
	`71`	`+ NegotiateAuthenticationStatusCode statusCode = UnixNegotiateAuthenticationPal.GetErrorCode(gex);`
	`72`	`+ if (statusCode <= NegotiateAuthenticationStatusCode.GenericFailure)`
	`73`	`+ {`
	`74`	`+ statusCode = NegotiateAuthenticationStatusCode.Unsupported;`
	`75`	`+ }`
	`76`	`+ return new UnsupportedNegotiateAuthenticationPal(serverOptions, statusCode);`
`73`	`77`	`}`
`74`	`78`	`catch (EntryPointNotFoundException)`
`75`	`79`	`{`
`@@ -184,22 +188,25 @@ public UnixNegotiateAuthenticationPal(NegotiateAuthenticationClientOptions clien`
`184`	`188`
`185`	`189`	`if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"Peer SPN-> '{_spn}'");`
`186`	`190`
`187`		`- if (clientOptions.Credential == CredentialCache.DefaultCredentials \|\|`
	`191`	`+ if (clientOptions.Credential == CredentialCache.DefaultNetworkCredentials \|\|`
`188`	`192`	`string.IsNullOrWhiteSpace(clientOptions.Credential.UserName) \|\|`
`189`	`193`	`string.IsNullOrWhiteSpace(clientOptions.Credential.Password))`
`190`	`194`	`{`
`191`	`195`	`if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, "using DefaultCredentials");`
`192`		`- _credentialsHandle = AcquireDefaultCredential();`
`193`	`196`
`194`	`197`	`if (_packageType == Interop.NetSecurityNative.PackageType.NTLM)`
`195`	`198`	`{`
`196`	`199`	`// NTLM authentication is not possible with default credentials which are no-op`
	`200`	`+ if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, SR.net_ntlm_not_possible_default_cred);`
`197`	`201`	`throw new PlatformNotSupportedException(SR.net_ntlm_not_possible_default_cred);`
`198`	`202`	`}`
`199`	`203`	`if (string.IsNullOrEmpty(_spn))`
`200`	`204`	`{`
	`205`	`+ if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, SR.net_nego_not_supported_empty_target_with_defaultcreds);`
`201`	`206`	`throw new PlatformNotSupportedException(SR.net_nego_not_supported_empty_target_with_defaultcreds);`
`202`	`207`	`}`
	`208`	`+`
	`209`	`+ _credentialsHandle = SafeGssCredHandle.Create(string.Empty, string.Empty, _packageType);`
`203`	`210`	`}`
`204`	`211`	`else`
`205`	`212`	`{`
`@@ -229,7 +236,7 @@ public UnixNegotiateAuthenticationPal(NegotiateAuthenticationServerOptions serve`
`229`	`236`
`230`	`237`	`if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(this, $"Peer SPN-> '{_spn}'");`
`231`	`238`
`232`		`- if (serverOptions.Credential == CredentialCache.DefaultCredentials \|\|`
	`239`	`+ if (serverOptions.Credential == CredentialCache.DefaultNetworkCredentials \|\|`
`233`	`240`	`string.IsNullOrWhiteSpace(serverOptions.Credential.UserName) \|\|`
`234`	`241`	`string.IsNullOrWhiteSpace(serverOptions.Credential.Password))`
`235`	`242`	`{`
`@@ -462,24 +469,7 @@ private static Interop.NetSecurityNative.PackageType GetPackageType(string packa`
`462`	`469`	`else`
`463`	`470`	`{`
`464`	`471`	`// Native shim currently supports only NTLM, Negotiate and Kerberos`
`465`		`- throw new PlatformNotSupportedException(SR.net_securitypackagesupport);`
`466`		`- }`
`467`		`- }`
`468`		`-`
`469`		`- private SafeGssCredHandle AcquireDefaultCredential()`
`470`		`- {`
`471`		`- try`
`472`		`- {`
`473`		`- return SafeGssCredHandle.Create(string.Empty, string.Empty, _packageType);`
`474`		`- }`
`475`		`- catch (Exception ex)`
`476`		`- {`
`477`		`- if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(this, ex);`
`478`		`-`
`479`		`- // NOTE: We throw PlatformNotSupportedException which is caught in`
`480`		`- // NegotiateAuthenticationPal.Create and transformed into instantiation of`
`481`		`- // UnsupportedNegotiateAuthenticationPal.`
`482`		`- throw new PlatformNotSupportedException(ex.Message, ex);`
	`472`	`+ throw new Interop.NetSecurityNative.GssApiException(Interop.NetSecurityNative.Status.GSS_S_UNAVAILABLE, 0);`
`483`	`473`	`}`
`484`	`474`	`}`
`485`	`475`
`@@ -511,14 +501,10 @@ private SafeGssCredHandle AcquireCredentialsHandle(NetworkCredential credential)`
`511`	`501`
`512`	`502`	`return SafeGssCredHandle.Create(username, password, _packageType);`
`513`	`503`	`}`
`514`		`- catch (Exception ex)`
	`504`	`+ catch (Exception ex) when (ex is not Interop.NetSecurityNative.GssApiException)`
`515`	`505`	`{`
`516`	`506`	`if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(this, ex);`
`517`		`-`
`518`		`- // NOTE: We throw PlatformNotSupportedException which is caught in`
`519`		`- // NegotiateAuthenticationPal.Create and transformed into instantiation of`
`520`		`- // UnsupportedNegotiateAuthenticationPal.`
`521`		`- throw new PlatformNotSupportedException(ex.Message, ex);`
	`507`	`+ throw new Interop.NetSecurityNative.GssApiException(Interop.NetSecurityNative.Status.GSS_S_BAD_NAME, 0);`
`522`	`508`	`}`
`523`	`509`	`}`
`524`	`510`
`@@ -753,7 +739,7 @@ private NegotiateAuthenticationStatusCode AcceptSecurityContext(`
`753`	`739`	`}`
`754`	`740`
`755`	`741`	`// https://www.gnu.org/software/gss/reference/gss.pdf (page 25)`
`756`		`- private static NegotiateAuthenticationStatusCode GetErrorCode(Interop.NetSecurityNative.GssApiException exception)`
	`742`	`+ internal static NegotiateAuthenticationStatusCode GetErrorCode(Interop.NetSecurityNative.GssApiException exception)`
`757`	`743`	`{`
`758`	`744`	`switch (exception.MajorStatus)`
`759`	`745`	`{`
Original file line number	Diff line number	Diff line change
`@@ -15,6 +15,7 @@ internal sealed class UnsupportedNegotiateAuthenticationPal : NegotiateAuthentic`
`15`	`15`	`{`
`16`	`16`	`private string _package;`
`17`	`17`	`private string? _targetName;`
	`18`	`+ private NegotiateAuthenticationStatusCode _statusCode;`
`18`	`19`
`19`	`20`	`public override bool IsAuthenticated => false;`
`20`	`21`	`public override bool IsSigned => false;`
`@@ -25,15 +26,17 @@ internal sealed class UnsupportedNegotiateAuthenticationPal : NegotiateAuthentic`
`25`	`26`	`public override IIdentity RemoteIdentity => throw new InvalidOperationException();`
`26`	`27`	`public override System.Security.Principal.TokenImpersonationLevel ImpersonationLevel => System.Security.Principal.TokenImpersonationLevel.Impersonation;`
`27`	`28`
`28`		`- public UnsupportedNegotiateAuthenticationPal(NegotiateAuthenticationClientOptions clientOptions)`
	`29`	`+ public UnsupportedNegotiateAuthenticationPal(NegotiateAuthenticationClientOptions clientOptions, NegotiateAuthenticationStatusCode statusCode = NegotiateAuthenticationStatusCode.Unsupported)`
`29`	`30`	`{`
`30`	`31`	`_package = clientOptions.Package;`
`31`	`32`	`_targetName = clientOptions.TargetName;`
	`33`	`+ _statusCode = statusCode;`
`32`	`34`	`}`
`33`	`35`
`34`		`- public UnsupportedNegotiateAuthenticationPal(NegotiateAuthenticationServerOptions serverOptions)`
	`36`	`+ public UnsupportedNegotiateAuthenticationPal(NegotiateAuthenticationServerOptions serverOptions, NegotiateAuthenticationStatusCode statusCode = NegotiateAuthenticationStatusCode.Unsupported)`
`35`	`37`	`{`
`36`	`38`	`_package = serverOptions.Package;`
	`39`	`+ _statusCode = statusCode;`
`37`	`40`	`}`
`38`	`41`
`39`	`42`	`public override void Dispose()`
`@@ -42,7 +45,7 @@ public override void Dispose()`
`42`	`45`
`43`	`46`	`public override byte[]? GetOutgoingBlob(ReadOnlySpan<byte> incomingBlob, out NegotiateAuthenticationStatusCode statusCode)`
`44`	`47`	`{`
`45`		`- statusCode = NegotiateAuthenticationStatusCode.Unsupported;`
	`48`	`+ statusCode = _statusCode;`
`46`	`49`	`return null;`
`47`	`50`	`}`
`48`	`51`
Original file line number	Diff line number	Diff line change
`@@ -94,6 +94,14 @@ public void Package_Unsupported_NTLM()`
`94`	`94`	`Assert.Equal(NegotiateAuthenticationStatusCode.Unsupported, statusCode);`
`95`	`95`	`}`
`96`	`96`
	`97`	`+ [Fact]`
	`98`	`+ [SkipOnPlatform(TestPlatforms.Windows, "The test is specific to GSSAPI / Managed implementations of NegotiateAuthentication")]`
	`99`	`+ public void DefaultNetworkCredentials_NTLM_Throws()`
	`100`	`+ {`
	`101`	`+ NegotiateAuthenticationClientOptions clientOptions = new NegotiateAuthenticationClientOptions { Package = "NTLM", Credential = CredentialCache.DefaultNetworkCredentials, TargetName = "HTTP/foo" };`
	`102`	`+ Assert.Throws<PlatformNotSupportedException>(() => new NegotiateAuthentication(clientOptions));`
	`103`	`+ }`
	`104`	`+`
`97`	`105`	`[Fact]`
`98`	`106`	`public void NtlmProtocolExampleTest()`
`99`	`107`	`{`