From 9950a3b4f6404dc683042532cbe88c1335e32631 Mon Sep 17 00:00:00 2001
From: Radek Zikmund <radekzikmund@microsoft.com>
Date: Fri, 5 Jun 2026 09:56:48 +0000
Subject: [PATCH] Throw PNSE when Extended Protection is used on unsupported
 platforms.

---
 .../System.Net.Security/src/Resources/Strings.resx        | 3 +++
 .../src/System/Net/Security/NegotiateAuthentication.cs    | 6 ++++++
 .../tests/UnitTests/NegotiateAuthenticationTests.cs       | 8 ++++++++
 3 files changed, 17 insertions(+)

diff --git a/src/libraries/System.Net.Security/src/Resources/Strings.resx b/src/libraries/System.Net.Security/src/Resources/Strings.resx
index 797fe50cf21021..e7445b5685ae95 100644
--- a/src/libraries/System.Net.Security/src/Resources/Strings.resx
+++ b/src/libraries/System.Net.Security/src/Resources/Strings.resx
@@ -311,6 +311,9 @@
   <data name="security_ExtendedProtectionPolicy_NoEmptyServiceNameCollection" xml:space="preserve">
     <value>The ServiceNameCollection must contain at least one service name.</value>
   </data>
+  <data name="net_extprotection_not_supported" xml:space="preserve">
+    <value>Extended Protection is not supported on this platform.</value>
+  </data>
   <data name="net_allocate_ssl_context_failed" xml:space="preserve">
     <value>Failed to allocate SSL/TLS context, OpenSSL error - {0}.</value>
   </data>
diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/NegotiateAuthentication.cs b/src/libraries/System.Net.Security/src/System/Net/Security/NegotiateAuthentication.cs
index 72fe830dff0d2a..b5c1be4e5ed76a 100644
--- a/src/libraries/System.Net.Security/src/System/Net/Security/NegotiateAuthentication.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/NegotiateAuthentication.cs
@@ -51,6 +51,12 @@ public NegotiateAuthentication(NegotiateAuthenticationServerOptions serverOption
         {
             ArgumentNullException.ThrowIfNull(serverOptions);
 
+            if (serverOptions.Policy?.PolicyEnforcement == PolicyEnforcement.Always &&
+                !ExtendedProtectionPolicy.OSSupportsExtendedProtection)
+            {
+                throw new PlatformNotSupportedException(SR.net_extprotection_not_supported);
+            }
+
             _isServer = true;
             _requestedPackage = serverOptions.Package;
             _requiredImpersonationLevel = serverOptions.RequiredImpersonationLevel;
diff --git a/src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs b/src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs
index 02fa64e8fb717f..70ab0a338c3b68 100644
--- a/src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs
+++ b/src/libraries/System.Net.Security/tests/UnitTests/NegotiateAuthenticationTests.cs
@@ -8,6 +8,7 @@
 using System.IO;
 using System.Net.Security;
 using System.Net.Test.Common;
+using System.Security.Authentication.ExtendedProtection;
 using System.Security.Principal;
 using System.Text;
 using System.Threading.Tasks;
@@ -530,5 +531,12 @@ public void NtlmMalformedChallenge_ReturnsInvalidToken(string scenario, Func<byt
             Assert.Equal(NegotiateAuthenticationStatusCode.InvalidToken, statusCode);
             Assert.Null(response);
         }
+
+        [Fact]
+        [PlatformSpecific(~TestPlatforms.Windows)]
+        public void ExtendedProtectionPolicy_NotSupportedOnUnix()
+        {
+            Assert.Throws<PlatformNotSupportedException>(() => new NegotiateAuthentication(new NegotiateAuthenticationServerOptions { Policy = new ExtendedProtectionPolicy(PolicyEnforcement.Always) }));
+        }
     }
 }