SSPI implementation converts SPN to Lowercase, Causing Authentication Failure with Non-Windows Machines

Open
#389 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
55/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
csharp
Domain
authentication, security

Research direction

Start at SspiSecurityContext.InitializeSecurityContext and trace where the supplied SPN is converted to lowercase. Reproduce the HTTP/myserver case, then verify that the original SPN casing is retained and authentication succeeds against a case-sensitive non-Windows Kerberos server.

Written by the indexing model from the issue text.

Description

bug

Description:
I am using a non-Windows machine with Kerberos protection, where the Service Principal Name (SPN) is case-sensitive. The SPN in my case is HTTP/myserver. However, Kerberos.NET's SspiSecurityContext.InitializeSecurityContext method converts the SPN to lowercase (http/myserver), causing authentication to fail because the server cannot verify the token with the altered SPN.

This behavior breaks compatibility with non-Windows Kerberos implementations, as many UNIX-based systems enforce case sensitivity for SPNs.

Steps to Reproduce:

Set up a Kerberos-protected non-Windows machine with an SPN HTTP/myserver.
Use Kerberos.NET SSPI to authenticate using the SPN HTTP/myserver.
Observe that the SPN is converted to http/myserver, resulting in authentication failure on the server.
Expected Behavior:
The SPN string provided to the SspiSecurityContext.InitializeSecurityContext method should remain in its original case to ensure compatibility with case-sensitive non-Windows servers.

Actual Behavior:
The SPN string is converted to lowercase (http/myserver), leading to token verification failure on the non-Windows server.

Environment:

Kerberos.NET version: [e.g., 4.6.70]
.NET version: [e.g., .NET 8.0]
Operating System: [e.g., Windows 10, Ubuntu 20.04]
Additional Information:

SPNs are case-insensitive on Windows systems but case-sensitive on many non-Windows systems.
Refer to Microsoft documentation for more information:
"Service Principal Names (SPNs) are not case sensitive when used by Microsoft Windows-based computers. However, many UNIX-based systems are case-sensitive and require the proper case to function properly."

A potential fix would be to avoid altering the case of the SPN string in SspiSecurityContext .InitializeSecurityContext.

Dominant language
C#
Stars
567
Forks
109
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dotnet/Kerberos.NET

All issues in dotnet/Kerberos.NET

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.