CSHARP-2366: GSSAPI Scram Authentication starts scram conversation wrong

Author: markbenvenuto

src/MongoDB.Driver.Core/Core/Authentication/GssapiAuthenticator.cs

@@ -196,7 +196,7 @@ public string Name
                 get { return MechanismName; }
             }
 
-            public ISaslStep Initialize(IConnection connection, ConnectionDescription description)
+            public ISaslStep Initialize(IConnection connection, SaslConversation conversation, ConnectionDescription description)
             {
                 Ensure.IsNotNull(connection, nameof(connection));
                 Ensure.IsNotNull(description, nameof(description));
@@ -229,17 +229,19 @@ public ISaslStep Initialize(IConnection connection, ConnectionDescription descri
                     }
                 }
 
-                return new FirstStep(_serviceName, hostName, _realm, _username, _password);
+                return new FirstStep(_serviceName, hostName, _realm, _username, _password, conversation);
             }
         }
 
         private class FirstStep : ISaslStep
         {
             private readonly string _authorizationId;
+            private byte[] _bytesToSendToServer;
+            private readonly Sspi.SecurityContext _context;
             private readonly SecureString _password;
             private readonly string _servicePrincipalName;
 
-            public FirstStep(string serviceName, string hostName, string realm, string username, SecureString password)
+            public FirstStep(string serviceName, string hostName, string realm, string username, SecureString password, SaslConversation conversation)
             {
                 _authorizationId = username;
                 _password = password;
@@ -248,20 +250,7 @@ public FirstStep(string serviceName, string hostName, string realm, string usern
                 {
                     _servicePrincipalName += "@" + realm;
                 }
-            }
-
-            public byte[] BytesToSendToServer
-            {
-                get { return new byte[0]; }
-            }
-
-            public bool IsComplete
-            {
-                get { return false; }
-            }
 
-            public ISaslStep Transition(SaslConversation conversation, byte[] bytesReceivedFromServer)
-            {
                 SecurityCredential securityCredential;
                 try
                 {
@@ -273,11 +262,9 @@ public ISaslStep Transition(SaslConversation conversation, byte[] bytesReceivedF
                     throw new MongoAuthenticationException(conversation.ConnectionId, "Unable to acquire security credential.", ex);
                 }
 
-                byte[] bytesToSendToServer;
-                Sspi.SecurityContext context;
                 try
                 {
-                    context = Sspi.SecurityContext.Initialize(securityCredential, _servicePrincipalName, bytesReceivedFromServer, out bytesToSendToServer);
+                    _context = Sspi.SecurityContext.Initialize(securityCredential, _servicePrincipalName, null, out _bytesToSendToServer);
                 }
                 catch (Win32Exception ex)
                 {
@@ -290,13 +277,36 @@ public ISaslStep Transition(SaslConversation conversation, byte[] bytesReceivedF
                         throw new MongoAuthenticationException(conversation.ConnectionId, "Unable to initialize security context.", ex);
                     }
                 }
+            }
+
+            public byte[] BytesToSendToServer
+            {
+                get { return _bytesToSendToServer; }
+            }
+
+            public bool IsComplete
+            {
+                get { return false; }
+            }
+
+            public ISaslStep Transition(SaslConversation conversation, byte[] bytesReceivedFromServer)
+            {
+                byte[] bytesToSendToServer;
+                try
+                {
+                    _context.Initialize(_servicePrincipalName, bytesReceivedFromServer, out bytesToSendToServer);
+                }
+                catch (Win32Exception ex)
+                {
+                    throw new MongoAuthenticationException(conversation.ConnectionId, "Unable to initialize security context", ex);
+                }
 
-                if (!context.IsInitialized)
+                if (!_context.IsInitialized)
                 {
-                    return new InitializeStep(_servicePrincipalName, _authorizationId, context, bytesToSendToServer);
+                    return new InitializeStep(_servicePrincipalName, _authorizationId, _context, bytesToSendToServer);
                 }
 
-                return new NegotiateStep(_authorizationId, context, bytesToSendToServer);
+                return new NegotiateStep(_authorizationId, _context, bytesToSendToServer);
             }
         }
 

src/MongoDB.Driver.Core/Core/Authentication/PlainAuthenticator.cs

@@ -77,7 +77,7 @@ public string Name
             }
 
             // methods
-            public ISaslStep Initialize(IConnection connection, ConnectionDescription description)
+            public ISaslStep Initialize(IConnection connection, SaslConversation conversation, ConnectionDescription description)
             {
                 Ensure.IsNotNull(connection, nameof(connection));
                 Ensure.IsNotNull(description, nameof(description));

src/MongoDB.Driver.Core/Core/Authentication/SaslAuthenticator.cs

@@ -67,7 +67,7 @@ public void Authenticate(IConnection connection, ConnectionDescription descripti
 
             using (var conversation = new SaslConversation(description.ConnectionId))
             {
-                var currentStep = _mechanism.Initialize(connection, description);
+                var currentStep = _mechanism.Initialize( connection, conversation, description);
 
                 var command = CreateStartCommand(currentStep);
                 while (true)
@@ -102,7 +102,7 @@ public async Task AuthenticateAsync(IConnection connection, ConnectionDescriptio
 
             using (var conversation = new SaslConversation(description.ConnectionId))
             {
-                var currentStep = _mechanism.Initialize(connection, description);
+                var currentStep = _mechanism.Initialize(connection, conversation, description);
 
                 var command = CreateStartCommand(currentStep);
                 while (true)
@@ -281,9 +281,10 @@ protected interface ISaslMechanism
             /// Initializes the mechanism.
             /// </summary>
             /// <param name="connection">The connection.</param>
+            /// <param name="conversation">The SASL conversation.</param>
             /// <param name="description">The connection description.</param>
             /// <returns>The initial SASL step.</returns>
-            ISaslStep Initialize(IConnection connection, ConnectionDescription description);
+            ISaslStep Initialize(IConnection connection, SaslConversation conversation, ConnectionDescription description);
         }
 
         /// <summary>

src/MongoDB.Driver.Core/Core/Authentication/ScramShaAuthenticator.cs

@@ -131,7 +131,7 @@ public ScramShaMechanism(
 
             public string Name => _name;
 
-            public ISaslStep Initialize(IConnection connection, ConnectionDescription description)
+            public ISaslStep Initialize(IConnection connection, SaslConversation conversation, ConnectionDescription description)
             {
                 Ensure.IsNotNull(connection, nameof(connection));
                 Ensure.IsNotNull(description, nameof(description));