Add better API to support communication with Kerberos endpoints

[wfurt]

We sort of have NegotiteStream to allow mutual Kerberos authentication. However, that is custom .NET extension and it does not work agains endpoint written in other languages.
For example #60906 caused crashing regression because SqlClient depends on runtime internals and it is hard to keep in sync.
Similarly PostgresSQL writes custom wrapper around NegotiateStream to strip and add fields to make it usable.

It would be nice to have enough public API surface so projects like this can use .NET directly without jumping through weird hoops.
We would need to work out details and either extend NegotiateStream or come up with separate stream class.

[ghost]

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

We sort of have NegotiteStream to allow mutual Kerberos authentication. However, that is custom .NET extension and it does not work agains endpoint written in other languages.
For example #60906 caused crashing regression because SqlClient depends on runtime internals and it is hard to keep in sync.
Similarly PostgresSQL writes custom wrapper around NegotiateStream to strip and add fields to make it usable.

It would be nice to have enough public API surface so projects like this can use .NET directly without jumping through weird hoops.
We would need to work out details and either extend NegotiateStream or come up with separate stream class.

Author:	wfurt
Assignees:	-
Labels:	enhancement, api-suggestion, area-System.Net.Security
Milestone:	-

[karelz]

Related to #29270

[karelz]

Triage: We would like to support database clients in better way in 7.0.

[filipnavara]

I checked what would be necessary to port dotnet/SqlClient to the new NegotiateAuthentication API. The missing piece are two flags on the authentication (Delegate, MutualAuth). API suggestion is in #70982.

[wfurt]

Thanks @filipnavara. The other chunk I"m aware of is Postgress Driver https://github.com/npgsql/npgsql/blob/00ee7a8a47cc61b9419dd334851ec5184ab5bcdd/src/Npgsql/Internal/NpgsqlConnector.Auth.cs

cc: @roji

[filipnavara]

PostgreSQL driver has essentially identical requirements. NPgSQL already wraps the public NegotiateStream API. It doesn't use the encrypt/decrypt part of NegotiateStream after authentication was established. #70982 API is basically guaranteed to cover the needs since I reimplemented full NegotiateStream authentication on top of it (+ the Wrap/Unwrap for encrypt/decrypt but that part is not necessary for NPgSQL).

[wfurt]

closing this as #70982 is merged.