[BUG] change token for validation in .net8

[korovindenis]

Description:

This PR addresses an issue related to the validation of the spnegoNegTokenRespKRBAcceptCompleted value. Specifically, the current value causes problems in .NET8 validation as described in dotnet/runtime#105574.

Changes Made:

• Updated the constant spnegoNegTokenRespKRBAcceptCompleted.
  The new value was obtained from RFC 4559.

Verification:

• The changes have been tested in an environment running .NET8 and .NET6, and the validation issue has been resolved.

Attachments:

example-net.zip
The archive contains two utilities compiled for .NET6 and .NET8
These utilities can be used to verify changes across environments with .NET 6 and .NET 8 to ensure that the validation issue has been resolved.
The source code for these utilities is available at dotnet/runtime#105574.

net.exe http://example.com/api

Thank you for considering this fix. Please let me know if any other information is required or if there are any additional changes needed.

[filipnavara]

I'm not sure this is the right fix. In fact, the values in RFC 4559 all seem odd, they are hex-encoded instead of base64-encoded and they are not valid ASN.1 payload (online decoder at https://asn1js.eu/).

The value oRQwEqADCgEAoQsGCSqGSIb3EgECAg== is syntactically valid payload:

[1] @0+20 (constructed): (1 elem)
  SEQUENCE @2+18 (constructed): (2 elem)
    [0] @4+3 (constructed): (1 elem)
      ENUMERATED @6+1: 0
    [1] @9+11 (constructed): (1 elem)
      OBJECT_IDENTIFIER @11+9: 1.2.840.113554.1.2.2

It says that the state is 0 (Accept Completed) and that the negotiated protocol is Kerberos (OID 1.2.840.113554.1.2.2).

That doesn't necessarily mean it's semantically valid though. There's more than one Kerberos OID and depending on what the client sends and the server accepts it has to be properly mirrored. Also, newer versions of SPNEGO require the message integrity check as part of the message in some cases to block downgrade attacks (modifying the first packet to offer different set of negotiated protocols and thus downgrading the security).