[ci-scan] Test failure: NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown returns UnknownCredentials

[lewing]

Description

System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown failed on Alpine 3.24 arm64: expected TargetUnknown, actual UnknownCredentials.

This issue tracks only this test and this specific status mismatch, not all Kerberos or channel-binding failures. The underlying cause is unresolved; this is not classified as a confirmed infrastructure failure.

Build Information

Build: runtime 1591715
Build error leg or test failing: linux_musl-arm64 checked CoreCLR_ReleaseLibraries / System.Net.Security.Tests
Pull request: #133639
Test result: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1591715&view=ms.vss-test-web.build-test-results-tab&runId=43936782&resultId=162038
Helix console: https://helix.dot.net/api/2019-06-17/jobs/a40b3316-de81-45c5-8c9e-013d84a12ab5/workitems/System.Net.Security.Tests/console

KBE authoring guidance (ci-failure-scan)

• Error Details is for readers. The exception and stack trace below identify the observed failure.
• Build Analysis parses only the single JSON block under Error Message.
• Each ErrorMessage array element is a case-sensitive literal substring copied from the failing console; elements match in order.
• BuildRetry is false because an infrastructure retry case has not been established. ExcludeConsoleLog is false to enable Helix console-log matching.

Reproduction Steps

Observed in the linked CI run on September 10, 2026, running System.Net.Security.Tests on Alpine arm64. The test uses an in-process KDC and attempts Kerberos authentication to an unregistered SPN. No deterministic local reproduction is established.

Expected behavior

GetOutgoingBlob reports NegotiateAuthenticationStatusCode.TargetUnknown for the unknown SPN.

Actual behavior

The result is NegotiateAuthenticationStatusCode.UnknownCredentials; the assertion fails inside the RemoteExecutor child process.

Error Details

System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown [FAIL]
  Microsoft.DotNet.RemoteExecutor.RemoteExecutionException : Remote process failed with an unhandled exception.
  Stack Trace:

    Child exception:
      Xunit.Sdk.EqualException: Assert.Equal() Failure: Values differ
    Expected: TargetUnknown
    Actual:   UnknownCredentials
    /_/src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.cs(103,0): at System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.<>c.<Client_UnknownSPN_ReturnsTargetUnknown>b__4_0()
    --- End of stack trace from previous location ---
    /_/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs(37,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
    /_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs(57,0): at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

    Child process:
      System.Net.Security.Tests, Version=11.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51 System.Net.Security.Tests.NegotiateAuthenticationKerberosTest+<>c Void <Client_UnknownSPN_ReturnsTargetUnknown>b__4_0()

The GSSAPI trace shows initial credential acquisition, a UDP request/reply with the local KDC, and destruction of the credential cache. It does not reach the expected unknown-service TGS request. The child-process abort follows the managed assertion; it is not evidence of an unexplained native crash.

Error Message

{
  "ErrorMessage": [
    "System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown [FAIL]",
    "Expected: TargetUnknown",
    "Actual:   UnknownCredentials"
  ],
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Agentic workflow metadata (ci-failure-scan)

Workflow artifact: ci-failure-scan
Artifact kind: kbe-verification
Verified match count: 1 hits in failure.log

Verified against the linked original Helix console. Array-element counts are 1, 2, and 2; the ordered match is at lines 46, 52, and 53. No element matches a PASS or SKIP line. Filed interactively at the user's request.

Regression?

Unknown. This exact test passes in an earlier main build 1591508 using the same Alpine container digest. PR #133639 changes CoreLib trimming substitutions and RuntimeFeatureTests rather than authentication code, so this failure appears independent, but an exact matching failure on main has not been established.

Known Workarounds

None established. No test quarantine or CI rerun is requested by this issue.

Configuration

.NET 11; Alpine 3.24 arm64; linux_musl-arm64 checked CoreCLR_ReleaseLibraries.

Container: mcr.microsoft.com/dotnet-buildtools/prereqs:alpine-3.24-helix-arm64v8@sha256:7229985457fd1fb60afe60d1550bc9ccf93c5d54d3429aba079f4de6a7ffe7cf.

Only this configuration is confirmed for this exact failure; platform specificity is unknown.

Other information

Related: #132994 reports ChannelBindings_Matching_Unique_Succeeds returning UnknownCredentials instead of Completed on Debian 13 arm32 in main build 1574201 (August 30). That is a different test/platform and is not evidence of an identical root cause. This KBE intentionally does not match that broader failure family.

Note

This issue was generated with GitHub Copilot assistance.

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1591715
Error message validated: [System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown [FAIL] Expected: TargetUnknown Actual: UnknownCredentials]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 9/11/2026 2:53:07 AM UTC

Report

Build	Repository	Test	Pull Request
1591715	dotnet/runtime	System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown	#133639

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	1	1

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.