Fix gss encryption on windows (#6556)

vonzshik · vonzshik · commit 92e3db41536a · 2026-04-24T12:09:02.000+03:00
Fixes #6555 (cherry picked from commit 2024d5a)
diff --git a/src/Npgsql/Internal/NpgsqlConnector.cs b/src/Npgsql/Internal/NpgsqlConnector.cs
@@ -679,7 +679,9 @@ internal async ValueTask<GssEncryptionResult> GSSEncrypt(bool async, bool isRequ
         {
             TargetName = targetName,
             RequireMutualAuthentication = true,
-            RequiredProtectionLevel = ProtectionLevel.EncryptAndSign
+            RequiredProtectionLevel = ProtectionLevel.EncryptAndSign,
+            // GSS encryption only works with kerberos
+            Package = "Kerberos"
         };
 
         NegotiateOptionsCallback?.Invoke(clientOptions);
diff --git a/test/Npgsql.Tests/ConnectionTests.cs b/test/Npgsql.Tests/ConnectionTests.cs
@@ -1596,7 +1596,7 @@ public async Task Sync_open_blocked_same_thread()
     }
 
     [Test, IssueLink("https://github.com/npgsql/npgsql/issues/6427")]
-    [Platform(Include = "Win")] // Hangs on linux and mac when server closes the socket
+    [Platform(Include = "Win")] // Hangs on linux and mac (probably because of missing kerberos token)
     public async Task Gss_encryption_retry_does_not_clear_pool()
     {
         if (IsMultiplexing)
@@ -1610,7 +1610,13 @@ public async Task Gss_encryption_retry_does_not_clear_pool()
         // Break connection on gss encryption request to force the client to create a new connection and retry again
         // This emulates the behavior of older versions of PostgreSQL or its forks, like Supabase
         await using var postmaster = PgPostmasterMock.Start(csb.ConnectionString, breakOnGssEncryptionRequest: true);
-        await using var dataSource = CreateDataSource(postmaster.ConnectionString);
+        await using var dataSource = CreateDataSource(builder =>
+        {
+            builder.ConnectionStringBuilder.ConnectionString = postmaster.ConnectionString;
+            // We use kerberos by default, which requires specific credentials to work
+            // Change it negotiate so SSPI on windows can use NTLM credentials
+            builder.UseNegotiateOptionsCallback(options => options.Package = "Negotiate");
+        });
 
         PgServerMock server;
 
