NegotiateStreamPal.Unix.cs does not support default auth

[arontsang]

Description

NegotiateStreamPal should support loading credential from NTLM_USER_FILE env var as per https://github.com/gssapi/gss-ntlmssp/blob/main/TESTING.txt

Delegating the credentials to gss-ntlmssp.

However, NegotiateStreamPal throws an exception before gss-ntlmssp has a chance to provide its own credentials.

Reproduction Steps

create an ntlm user file as per https://github.com/gssapi/gss-ntlmssp/blob/main/TESTING.txt
Set NTLM_USER_FILE env var to point to said file.
Then do an http get from an NTLM web server.

Expected behavior

HTTP 200

Actual behavior

System.PlatformNotSupportedException: NTLM authentication is not possible with default credentials on this platform.

Regression?

No response

Known Workarounds

Provide the credentials from dotnet. Which is a security risk that is advised against specifically.

Configuration

OS = Amazon Linux 2
Dotnet 3.1

Other information

No response

[ghost]

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

NegotiateStreamPal should support loading credential from NTLM_USER_FILE env var as per https://github.com/gssapi/gss-ntlmssp/blob/main/TESTING.txt

Delegating the credentials to gss-ntlmssp.

However, NegotiateStreamPal throws an exception before gss-ntlmssp has a chance to provide its own credentials.

Reproduction Steps

create an ntlm user file as per https://github.com/gssapi/gss-ntlmssp/blob/main/TESTING.txt
Set NTLM_USER_FILE env var to point to said file.
Then do an http get from an NTLM web server.

Expected behavior

HTTP 200

Actual behavior

System.PlatformNotSupportedException: NTLM authentication is not possible with default credentials on this platform.

Regression?

No response

Known Workarounds

Provide the credentials from dotnet. Which is a security risk that is advised against specifically.

Configuration

OS = Amazon Linux 2
Dotnet 3.1

Other information

No response

Author:	arontsang
Assignees:	-
Labels:	area-System.Net, untriaged
Milestone:	-

[ghost]

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

NegotiateStreamPal should support loading credential from NTLM_USER_FILE env var as per https://github.com/gssapi/gss-ntlmssp/blob/main/TESTING.txt

Delegating the credentials to gss-ntlmssp.

However, NegotiateStreamPal throws an exception before gss-ntlmssp has a chance to provide its own credentials.

Reproduction Steps

create an ntlm user file as per https://github.com/gssapi/gss-ntlmssp/blob/main/TESTING.txt
Set NTLM_USER_FILE env var to point to said file.
Then do an http get from an NTLM web server.

Expected behavior

HTTP 200

Actual behavior

System.PlatformNotSupportedException: NTLM authentication is not possible with default credentials on this platform.

Regression?

No response

Known Workarounds

Provide the credentials from dotnet. Which is a security risk that is advised against specifically.

Configuration

OS = Amazon Linux 2
Dotnet 3.1

Other information

No response

Author:	arontsang
Assignees:	-
Labels:	area-System.Net.Security, untriaged
Milestone:	-

[karelz]

Triage:

• On one hand it is implementation detail of gss
• On the other hand, it would be useful to have -- we need to understand how portable it is - is it Unix only? What about Mac? Something similar on Windows? ... What about security implications?

[wfurt]

We should not process the file directly but we can let gssapi to decide instead of failing early in NegotiateStream.