The Wire · Showcase
RUNTIME FIXES KERBEROS FALLBACK ON UNIX, APPHOST CONVERTS TO C
By RepoJournal · Filed · About .NET
The managed SPNEGO implementation now falls back to NTLM when Kerberos credentials go missing on Linux, closing a critical auth gap that broke enterprise deployments [ref:1].
Unix systems running the managed Negotiate handler hit a wall when KDC/TGT wasn't available: they'd error out instead of gracefully stepping down to NTLM like OpenBSD already did [1]. That's fixed. Simultaneously, the apphost binary has moved from C++ to C [2], separating entry points for apphost and dotnet while keeping the singlefilehost resolver in C++ for static linking. On the configuration front, the binder source generator now ignores unresolvable metadata types to prevent uncompilable output from transitive assembly references [3]. The JIT got a win optimizing async helpers known to always suspend, skipping unnecessary continuation checks [4]. EventSource's varargs WriteEvent path has been realigned with typed-event semantics for correct EventPipe/ETW keyword filtering [5]. Across the broader ecosystem, dotnet/android restored Java.Interop value manager tests that CoreCLR's default runtime had unconditionally removed [6], while the codeflow pipeline delivered updates from runtime, aspnetcore, fsharp, winforms, and arcade into the main dotnet repo [7].
One email a day. Unsubscribe in one click.
Keep up with .NET in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Verify managed SPNEGO deployments on Linux can now reach NTLM fallback dotnet/runtime [plan]
- → Test apphost C conversion in your build pipelines before production rollout dotnet/runtime [plan]
- → Review Configuration Binder SG output if you use transitive type references dotnet/runtime [monitor]
- → Pull latest codeflow updates into your dotnet main builds dotnet/dotnet [monitor]
References
- [1] Fall back to NTLM in managed SPNEGO when Kerberos credentials are missing on Unix (#131195) dotnet/runtime
- [2] Convert apphost to C ↗ dotnet/runtime
- [3] Configuration Binder SG: ignore unresolvable metadata types to prevent ambiguous/missing-type emissions ↗ dotnet/runtime
- [4] JIT: Optimize always suspending helpers ↗ dotnet/runtime
- [5] Fix EventSource WriteEvent varargs overloads dropped from EventPipe ↗ dotnet/runtime
- [6] [tests] Restore Java.Interop value manager tests (#12225) dotnet/android
- [7] [main] Source code updates from dotnet/runtime ↗ dotnet/dotnet