GetServicePrincipalNegotiationTokenAsync utility duplicates domain name ( user@domain@domain)

[ionmincu]

Describe the bug
Using KerberosAuthMethodHelper.GetServicePrincipalNegotiationTokenAsync duplicates the domain name.

VaultSharp Version
1.17.5.1

Vault Version
Vault v1.18.0 (77f26ba561a4b6b1ccd5071b8624cefef7a72e84), built 2024-10-08T09:12:52Z

Does this work with Vault CLI?
Yes

Sample Code Snippet
Output from Vault CLI

PS C:\Programs\vault> .\vault login -method=kerberos username=ion.mincu service=HTTP/im-ws2019-01 realm=DESKOVER.LOCAL keytab_path=ion.mincu.keytab krb5conf_path=krb5.conf disable_fast_negotiation=true
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "vault login"
again. Future Vault requests will automatically use this token.

Key                  Value
---                  -----
token                hvs.CAESIE289Dkbm3LysjR8NKVPP-BKKUt94wKzaQqBDesF-pVsGh4KHGh2cy5XbzBMR3NTVGhOaUtDblJOT3BJRlQ3WG4
token_accessor       IKnwddD0Acz6JrLteuCdM9Un
token_duration       768h
token_renewable      false
token_policies       ["default"]
identity_policies    []
policies             ["default"]
token_meta_domain    DESKOVER.LOCAL
token_meta_user      ion.mincu
PS C:\Programs\vault> .\vault -v
Vault v1.18.0 (77f26ba561a4b6b1ccd5071b8624cefef7a72e84), built 2024-10-08T09:12:52Z

Using the exact same keytab

public async static Task PostRequest()
{
    var token = await KerberosAuthMethodHelper.GetServicePrincipalNegotiationTokenAsync("ion.mincu", "HTTP/im-ws2019-01", "DESKOVER.LOCAL", _keyTabPath, _krb5conf, true, factory);
    
    var handler = new HttpClientHandler()
    {
        // Proxy = new WebProxy { BypassProxyOnLocal = true },
        PreAuthenticate = true,
        UseDefaultCredentials = true,
        AllowAutoRedirect = true,
        // Credentials = CredentialCache.DefaultNetworkCredentials
    };

    using (var client = new HttpClient(handler))
    {
        client.BaseAddress = new Uri("http://im-ws2019-01.deskover.local:8200/");
        client.DefaultRequestHeaders.Add("Authorization", token);

        var content = new StringContent("null");

        var response = await client.PostAsync("v1/auth/kerberos/login", content);

        // If the request is successful, read the response body as string
        if (response.IsSuccessStatusCode)
        {
            var responseBody = await response.Content.ReadAsStringAsync();
            Console.WriteLine(responseBody);
        }
        else
        {
            Console.WriteLine($"Error when posting manually: {response.StatusCode}");
        }
    }
}

Exception Details/Stack Trace/Error Message
Error message, stack trace you see

Any additional info
Vault logs when logging in with CLI

10:34:11.688+0200 [INFO]  auth.kerberos.auth_kerberos_6e6adb1a: 127.0.0.1:8080 ion.mincu@DESKOVER.LOCAL - SPNEGO authentication succeeded
10:34:11.689+0200 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: identity: &{username:ion.mincu displayName:Ion Mincu realm:DESKOVER.LOCAL cname:{NameType:1 NameString:[ion.mincu]} keytab:0xc003304f80 password: attributes:map[gokrb5AttributeKeyADCredentials:{EffectiveName:ion.mincu FullName:Ion Mincu UserID:35254 PrimaryGroupID:513 LogOnTime:{wall:93939700 ext:63865960455 loc:<nil>} LogOffTime:{wall:709551516 ext:68937867273 loc:<nil>} PasswordLastSet:{wall:668273300 ext:63865351735 loc:<nil>} GroupMembershipSIDs:[S-1-5-21-1667818259-1789684151-1906802761-35255 S-1-5-21-1667818259-1789684151-1906802761-513 S-1-18-1] LogonDomainName:DESKOVER LogonDomainID:S-1-5-21-1667818259-1789684151-1906802761 LogonServer:ROINFRAWDDC01}] validUntil:{wall:0 ext:63865996455 loc:<nil>} authenticated:true human:true authTime:{wall:688330400 ext:63865960451 loc:<nil>} groupMembership:map[S-1-18-1:true S-1-5-21-1667818259-1789684151-1906802761-35255:true S-1-5-21-1667818259-1789684151-1906802761-513:true] sessionID:0643c91b-28a6-76d2-a078-6d193370ac40}
10:34:11.699+0200 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: compiling search filter: search_filter="({{.UserAttr}}={{.Username}})"
10:34:11.699+0200 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: discovering user: userdn="OU=deskover,DC=deskover,DC=local" filter="(userPrincipalName=ion.mincu@DESKOVER.LOCAL)"
10:34:11.700+0200 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: auth/ldap: User BindDN fetched: username=ion.mincu binddn="CN=Ion Mincu,OU=Engineering,OU=deskover,DC=deskover,DC=local"
10:34:11.704+0200 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: searching upn: userdn="OU=deskover,DC=deskover,DC=local" filter="(userPrincipalName=ion.mincu@DESKOVER.LOCAL)"
10:34:11.706+0200 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: compiling group filter: group_filter="(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))"
10:34:11.706+0200 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: searching: groupdn="DC=DESKOVER,DC=LOCAL" rendered_query="(|(memberUid=ion.mincu)(member=CN=Ion Mincu,OU=Engineering,OU=deskover,DC=deskover,DC=local)(uniqueMember=CN=Ion Mincu,OU=Engineering,OU=deskover,DC=deskover,DC=local))"
10:34:12.071+0200 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: auth/ldap: Groups fetched from server: num_server_groups=1 server_groups=["Engineering_Local_Admins"]
10:34:12.071+0200 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: unable to find Engineering_Local_Admins, does not currently exist

Vault logs when logging in with C# code notice the principal is ion.mincu@DESKOVER.LOCAL@DESKOVER.LOCAL

10:29:38.623 [INFO]  auth.kerberos.auth_kerberos_6e6adb1a: 10.10.16.150:8080 ion.mincu@DESKOVER.LOCAL@DESKOVER.LOCAL - SPNEGO authentication succeeded
10:29:38.624 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: identity: &{username:ion.mincu@DESKOVER.LOCAL displayName:ion.mincu@DESKOVER.LOCAL realm:DESKOVER.LOCAL cname:{NameType:10 NameString:[ion.mincu@DESKOVER.LOCAL]} keytab:0xc0049ff1c0 password: attributes:map[] validUntil:{wall:0 ext:63865996177 loc:<nil>} authenticated:true human:true authTime:{wall:623712200 ext:63865960178 loc:<nil>} groupMembership:map[] sessionID:e6bad2f4-a60f-2f0d-c4e6-673c5c21013b}
10:29:38.632 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: compiling search filter: search_filter="({{.UserAttr}}={{.Username}})"
10:29:38.632 [DEBUG] auth.kerberos.auth_kerberos_6e6adb1a: discovering user: userdn="OU=deskover,DC=deskover,DC=local" filter="(userPrincipalName=ion.mincu@DESKOVER.LOCAL@DESKOVER.LOCAL)"