Add additional security checks for GSS session encryption and GSS authentication (#6525)

vonzshik · vonzshik · commit d599de99fde6 · 2026-04-13T15:40:21.000+03:00
Closes #6523 (cherry picked from commit 5f26d61)
diff --git a/src/Npgsql/Internal/NpgsqlConnector.Auth.cs b/src/Npgsql/Internal/NpgsqlConnector.Auth.cs
@@ -330,8 +330,14 @@ async Task AuthenticateMD5(string username, byte[] salt, bool async, Cancellatio
     internal async ValueTask AuthenticateGSS(bool async, CancellationToken cancellationToken)
     {
         var targetName = $"{KerberosServiceName}/{Host}";
+        // See https://github.com/postgres/postgres/blob/a0dd0702e464f206b08c99a74cb58809c51aafa5/src/interfaces/libpq/fe-auth.c#L111-L123
+        // We do not support delegation (TokenImpersonationLevel.Delegation) for now (#6540)
+        var clientOptions = new NegotiateAuthenticationClientOptions
+        {
+            TargetName = targetName,
+            RequireMutualAuthentication = true
+        };
 
-        var clientOptions = new NegotiateAuthenticationClientOptions { TargetName = targetName };
         NegotiateOptionsCallback?.Invoke(clientOptions);
 
         using var authContext = new NegotiateAuthentication(clientOptions);
diff --git a/src/Npgsql/Internal/NpgsqlConnector.cs b/src/Npgsql/Internal/NpgsqlConnector.cs
@@ -673,7 +673,14 @@ internal async ValueTask<GssEncryptionResult> GSSEncrypt(bool async, bool isRequ
         ConnectionLogger.LogTrace("Negotiating GSS encryption");
 
         var targetName = $"{KerberosServiceName}/{Host}";
-        var clientOptions = new NegotiateAuthenticationClientOptions { TargetName = targetName };
+        // See https://github.com/postgres/postgres/blob/a0dd0702e464f206b08c99a74cb58809c51aafa5/src/interfaces/libpq/fe-secure-gssapi.c#L651-L658
+        // We do not support delegation (TokenImpersonationLevel.Delegation) for now (#6540)
+        var clientOptions = new NegotiateAuthenticationClientOptions
+        {
+            TargetName = targetName,
+            RequireMutualAuthentication = true,
+            RequiredProtectionLevel = ProtectionLevel.EncryptAndSign
+        };
 
         NegotiateOptionsCallback?.Invoke(clientOptions);
 
