Skip to content

System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.ChannelBindings_Mismatched_Endpoint_FailsWithBadBinding #134778

Open
Bug
Open
System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.ChannelBindings_Mismatched_Endpoint_FailsWithBadBinding#134778
Bug
Labels
Known Build ErrorUse this to report build issues in the .NET Helix tabarea-System.Net.Securityblocking-clean-ciBlocking PR or rolling runs of 'runtime' or 'runtime-extra-platforms'
Milestone
12.0.0

Description

@MichalStrehovsky
MichalStrehovsky
opened on Sep 28, 2026
Unhandled Exception:
Xunit.Sdk.EqualException: Assert.Equal() Failure: Values differ
Expected: BadBinding
Actual:   GenericFailure
   at Xunit.Assert.Equal[NegotiateAuthenticationStatusCode](NegotiateAuthenticationStatusCode expected, NegotiateAuthenticationStatusCode actual, IEqualityComparer`1 comparer) in /_/src/arcade/src/Microsoft.DotNet.XUnitAssert/src/EqualityAsserts.cs:line 102
   at Xunit.Assert.Equal[NegotiateAuthenticationStatusCode](NegotiateAuthenticationStatusCode expected, NegotiateAuthenticationStatusCode actual) in /_/src/arcade/src/Microsoft.DotNet.XUnitAssert/src/EqualityAsserts.cs:line 36
   at System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.RunMismatch(ChannelBindingKind kind) in /_/src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.ChannelBindings.cs:line 99
   at System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.<>c.<RunMismatchTest>b__10_0() in /_/src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.ChannelBindings.cs:line 51
   at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args) in /_/src/mono/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.Mono.cs:line 22
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr) in /_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs:line 57
--- End of stack trace from previous location ---
   at Microsoft.DotNet.RemoteExecutor.Program.Main(String[] args) in /_/src/arcade/src/Microsoft.DotNet.RemoteExecutor/src/Program.cs:line 97
[ERROR] FATAL UNHANDLED EXCEPTION: Xunit.Sdk.EqualException: Assert.Equal() Failure: Values differ
Expected: BadBinding
Actual:   GenericFailure
   at Xunit.Assert.Equal[NegotiateAuthenticationStatusCode](NegotiateAuthenticationStatusCode expected, NegotiateAuthenticationStatusCode actual, IEqualityComparer`1 comparer) in /_/src/arcade/src/Microsoft.DotNet.XUnitAssert/src/EqualityAsserts.cs:line 102
   at Xunit.Assert.Equal[NegotiateAuthenticationStatusCode](NegotiateAuthenticationStatusCode expected, NegotiateAuthenticationStatusCode actual) in /_/src/arcade/src/Microsoft.DotNet.XUnitAssert/src/EqualityAsserts.cs:line 36
   at System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.RunMismatch(ChannelBindingKind kind) in /_/src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.ChannelBindings.cs:line 99
   at System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.<>c.<RunMismatchTest>b__10_0() in /_/src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.ChannelBindings.cs:line 51
   at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args) in /_/src/mono/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.Mono.cs:line 22
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr) in /_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs:line 57
--- End of stack trace from previous location ---
   at Microsoft.DotNet.RemoteExecutor.Program.Main(String[] args) in /_/src/arcade/src/Microsoft.DotNet.RemoteExecutor/src/Program.cs:line 97
    System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.ChannelBindings_Mismatched_Endpoint_FailsWithBadBinding [FAIL]
      Microsoft.DotNet.RemoteExecutor.RemoteExecutionException : Remote process failed with an unhandled exception.
      Stack Trace:
        
        Child exception:
          Xunit.Sdk.EqualException: Assert.Equal() Failure: Values differ
        Expected: BadBinding
        Actual:   GenericFailure
        /_/src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.ChannelBindings.cs(99,0): at System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.RunMismatch(ChannelBindingKind kind)
        /_/src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.ChannelBindings.cs(51,0): at System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.<>c.<RunMismatchTest>b__10_0()
        /_/src/mono/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.Mono.cs(22,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
        /_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs(57,0): at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)
        
        Child process:
          System.Net.Security.Tests, Version=11.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51 System.Net.Security.Tests.NegotiateAuthenticationKerberosTest+<>c Void <RunMismatchTest>b__10_0()
        
        
      Output:
        [Verbose] [Kerberos.NET.Server.KdcAsReqMessageHandler] AS-REQ requires pre-auth for user user
        [Info] [Kerberos.NET.Server.KdcTgsReqMessageHandler] TGS-REQ incoming. SPN = krbtgt/CONTOSO.COM, Realm LINUX.CONTOSO.COM
        [Verbose] [Kerberos.NET.Server.KdcTgsReqMessageHandler] Default policy evaluated for user to krbtgt/COM
        GSSAPI trace:
        [5103] 1790571214.250011: Resolving unique ccache of type MEMORY
        [5103] 1790571214.250082: Getting initial credentials for user@LINUX.CONTOSO.COM
        [5103] 1790571214.250231: Error loading plugin module pkinit: 2/unable to load plugin [/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/pkinit.so]: /usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/pkinit.so: cannot open shared object file: No such file or directory
        [5103] 1790571214.250476: Sending unauthenticated request
        [5103] 1790571214.250491: Sending request (188 bytes) to LINUX.CONTOSO.COM
        [5103] 1790571214.250536: Resolving hostname 127.0.0.1
        [5103] 1790571214.250698: Sending initial UDP request to dgram 127.0.0.1:44911
        [5103] 1790571214.250763: Initiating TCP connection to stream 127.0.0.1:44911
        [5103] 1790571214.250900: Sending TCP request to stream 127.0.0.1:44911
        [5103] 1790571214.251436: Received answer (266 bytes) from stream 127.0.0.1:44911
        [5103] 1790571214.251445: Terminating TCP connection to stream 127.0.0.1:44911
        [5103] 1790571214.251494: Received error from KDC: -1765328359/Additional pre-authentication required
        [5103] 1790571214.251518: Preauthenticating using KDC method data
        [5103] 1790571214.251526: Processing preauth types: PA-ENC-TIMESTAMP (2), PA-ETYPE-INFO2 (19)
        [5103] 1790571214.251538: Selected etype info: etype aes256-cts, salt "LINUX.CONTOSO.COMuser", params ""
        [5103] 1790571214.259119: AS key obtained for encrypted timestamp: aes256-cts/E768
        [5103] 1790571214.259161: Encrypted timestamp (for 1790571214.7630): plain 3019A011180F32303236303932383034353333345AA10402021DCE, encrypted 59907DD5F3F568887AF4DF6FEA2DCD6C29CCDC08FB5755232EA490572B1690A62DD78BFF08DBA963E19F762CB3DF2A9C49220684E8343F
        [5103] 1790571214.259174: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
        [5103] 1790571214.259180: Produced preauth for next request: PA-ENC-TIMESTAMP (2)
        [5103] 1790571214.259193: Sending request (267 bytes) to LINUX.CONTOSO.COM
        [5103] 1790571214.259201: Resolving hostname 127.0.0.1
        [5103] 1790571214.259285: Sending initial UDP request to dgram 127.0.0.1:44911
        [5103] 1790571214.259331: Initiating TCP connection to stream 127.0.0.1:44911
        [5103] 1790571214.259391: Sending TCP request to stream 127.0.0.1:44911
        [5103] 1790571214.260045: Received answer (715 bytes) from stream 127.0.0.1:44911
        [5103] 1790571214.260054: Terminating TCP connection to stream 127.0.0.1:44911
        [5103] 1790571214.260081: Processing preauth types: (empty)
        [5103] 1790571214.260089: Produced preauth for next request: (empty)
        [5103] 1790571214.260096: AS key determined by preauth: aes256-cts/E768
        [5103] 1790571214.260146: Decrypted AS reply; session key is: aes256-cts/ED0E
        [5103] 1790571214.260156: FAST negotiation: unavailable
        [5103] 1790571214.260167: Resolving unique ccache of type MEMORY
        [5103] 1790571214.260180: Initializing MEMORY:rlv1iQU with default princ user@LINUX.CONTOSO.COM
        [5103] 1790571214.260187: Storing config in MEMORY:rlv1iQU for krbtgt/LINUX.CONTOSO.COM@LINUX.CONTOSO.COM: pa_type: 2
        [5103] 1790571214.260196: Storing user@LINUX.CONTOSO.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/LINUX.CONTOSO.COM\@LINUX.CONTOSO.COM@X-CACHECONF: in MEMORY:rlv1iQU
        [5103] 1790571214.260207: Storing user@LINUX.CONTOSO.COM -> krbtgt/LINUX.CONTOSO.COM@LINUX.CONTOSO.COM in MEMORY:rlv1iQU
        [5103] 1790571214.260213: Moving ccache MEMORY:rlv1iQU to MEMORY:kpgtbeJ
        [5103] 1790571214.260231: Destroying ccache MEMORY:rlv1iQU
        [5103] 1790571214.283023: Getting credentials user@LINUX.CONTOSO.COM -> HTTP/linux.contoso.com@ using ccache MEMORY:kpgtbeJ
        [5103] 1790571214.283057: Retrieving user@LINUX.CONTOSO.COM -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:kpgtbeJ with result: -1765328243/Matching credential not found
        [5103] 1790571214.283072: Retrieving user@LINUX.CONTOSO.COM -> HTTP/linux.contoso.com@ from MEMORY:kpgtbeJ with result: -1765328243/Matching credential not found
        [5103] 1790571214.283083: Retrying user@LINUX.CONTOSO.COM -> HTTP/linux.contoso.com@LINUX.CONTOSO.COM with result: -1765328243/Matching credential not found
        [5103] 1790571214.283090: Server has referral realm; starting with HTTP/linux.contoso.com@LINUX.CONTOSO.COM
        [5103] 1790571214.283117: Retrieving user@LINUX.CONTOSO.COM -> krbtgt/LINUX.CONTOSO.COM@LINUX.CONTOSO.COM from MEMORY:kpgtbeJ with result: 0/Success
        [5103] 1790571214.283124: Starting with TGT for client realm: user@LINUX.CONTOSO.COM -> krbtgt/LINUX.CONTOSO.COM@LINUX.CONTOSO.COM
        [5103] 1790571214.283131: Requesting tickets for HTTP/linux.contoso.com@LINUX.CONTOSO.COM, referrals on
        [5103] 1790571214.283149: Generated subkey for TGS request: aes256-cts/0570
        [5103] 1790571214.283177: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, camellia128-cts, camellia256-cts
        [5103] 1790571214.283227: Encoding request body and padata into FAST request
        [5103] 1790571214.283262: Sending request (931 bytes) to LINUX.CONTOSO.COM
        [5103] 1790571214.283317: Resolving hostname 127.0.0.1
        [5103] 1790571214.283410: Sending initial UDP request to dgram 127.0.0.1:44911
        [5103] 1790571214.283439: Received answer (931 bytes) from dgram 127.0.0.1:44911
        [5103] 1790571214.283454: TGS request result: -1765328344/Invalid message type
        [5103] 1790571214.283467: Local realm referral failed; trying fallback realm CONTOSO.COM
        [5103] 1790571214.283481: Retrieving user@LINUX.CONTOSO.COM -> krbtgt/CONTOSO.COM@CONTOSO.COM from MEMORY:kpgtbeJ with result: -1765328243/Matching credential not found
        [5103] 1790571214.283494: Retrieving user@LINUX.CONTOSO.COM -> krbtgt/LINUX.CONTOSO.COM@LINUX.CONTOSO.COM from MEMORY:kpgtbeJ with result: 0/Success
        [5103] 1790571214.283500: Starting with TGT for client realm: user@LINUX.CONTOSO.COM -> krbtgt/LINUX.CONTOSO.COM@LINUX.CONTOSO.COM
        [5103] 1790571214.283511: Retrieving user@LINUX.CONTOSO.COM -> krbtgt/CONTOSO.COM@CONTOSO.COM from MEMORY:kpgtbeJ with result: -1765328243/Matching credential not found
        [5103] 1790571214.283518: Requesting TGT krbtgt/CONTOSO.COM@LINUX.CONTOSO.COM using TGT krbtgt/LINUX.CONTOSO.COM@LINUX.CONTOSO.COM
        [5103] 1790571214.283530: Generated subkey for TGS request: aes256-cts/1C18
        [5103] 1790571214.283548: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, camellia128-cts, camellia256-cts
        [5103] 1790571214.283582: Encoding request body and padata into FAST request
        [5103] 1790571214.283615: Sending request (923 bytes) to LINUX.CONTOSO.COM
        [5103] 1790571214.283624: Resolving hostname 127.0.0.1
        [5103] 1790571214.283699: Sending initial UDP request to dgram 127.0.0.1:44911
        [5103] 1790571214.283758: Initiating TCP connection to stream 127.0.0.1:44911
        [5103] 1790571214.283834: Sending TCP request to stream 127.0.0.1:44911
        [5103] 1790571214.303325: Received answer (679 bytes) from stream 127.0.0.1:44911
        [5103] 1790571214.303352: Terminating TCP connection to stream 127.0.0.1:44911
        [5103] 1790571214.303395: Decoding FAST response
        [5103] 1790571214.303457: TGS request result: -1765328237/KDC reply did not match expectations
        [5103] 1790571214.360936: Destroying ccache MEMORY:kpgtbeJ

Build Information

Build: https://dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_build/results?buildId=1614159
Build error leg or test failing: System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.ChannelBindings_Mismatched_Endpoint_FailsWithBadBinding
Pull request: #134639

Error Message

DO NOT USE JSON BELOW IF THIS IS A BUILD BREAK otherwise build analysis will allow pull requests to merge that break the build worse. For a build break, do not use this issue form. Make a regular new issue.

Fill the error message using step by step known issues guidance.

{
  "ErrorMessage": ["Expected: BadBinding", "ChannelBindings_Mismatched_Endpoint_FailsWithBadBinding [FAIL]"],
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1614159
Error message validated: [Expected: BadBinding ChannelBindings_Mismatched_Endpoint_FailsWithBadBinding [FAIL]]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 9/28/2026 6:27:39 AM UTC

Report

Build Repository Test Pull Request
1620751 dotnet/runtime System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.ChannelBindings_Mismatched_Endpoint_FailsWithBadBinding #134260
1614159 dotnet/runtime System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.ChannelBindings_Mismatched_Endpoint_FailsWithBadBinding #134639

Summary

24-Hour Hit Count 7-Day Hit Count 1-Month Count
0 0 2

Activity

  1. MichalStrehovsky
    added
    area-System.Net.Security
    blocking-clean-ciBlocking PR or rolling runs of 'runtime' or 'runtime-extra-platforms'
    Known Build ErrorUse this to report build issues in the .NET Helix tab
    on Sep 28, 2026
  2. dotnet-policy-service
    added
    untriagedNew issue has not been triaged by the area owner
    on Sep 28, 2026

  3. dotnet-policy-service commented on Sep 28, 2026

    @dotnet-policy-service
    dotnet-policy-servicebot
    on Sep 28, 2026 – with Dotnet Policy Service
    Contributor

    Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
    See info in area-owners.md if you want to be subscribed.

  4. wfurt
    removed
    untriagedNew issue has not been triaged by the area owner
    on Sep 28, 2026
  5. wfurt
    added this to the 12.0.0 milestone on Sep 28, 2026
  6. rzikm
    added the
    Bug
    issue type on Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Known Build ErrorUse this to report build issues in the .NET Helix tabarea-System.Net.Securityblocking-clean-ciBlocking PR or rolling runs of 'runtime' or 'runtime-extra-platforms'

    Type

    Bug

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions