@@ -16,7 +16,7 @@ class IntegratedSecurityHandler
         return new();
     }
 
-    public virtual ValueTask NegotiateAuthentication(bool async, NpgsqlConnector connector, CancellationToken cancellationToken)
+    public virtual ValueTask NegotiateAuthentication(bool async, bool isKerberos, NpgsqlConnector connector, CancellationToken cancellationToken)
         => throw new NotSupportedException(string.Format(NpgsqlStrings.IntegratedSecurityDisabled, nameof(NpgsqlSlimDataSourceBuilder.EnableIntegratedSecurity)));
 
     public virtual ValueTask<GssEncryptionResult> GSSEncrypt(bool async, bool isRequired, NpgsqlConnector connector, CancellationToken cancellationToken)
@@ -30,8 +30,8 @@ sealed class RealIntegratedSecurityHandler : IntegratedSecurityHandler
     public override ValueTask<string?> GetUsername(bool async, bool includeRealm, ILogger connectionLogger, CancellationToken cancellationToken)
         => KerberosUsernameProvider.GetUsername(async, includeRealm, connectionLogger, cancellationToken);
 
-    public override ValueTask NegotiateAuthentication(bool async, NpgsqlConnector connector, CancellationToken cancellationToken)
-        => connector.AuthenticateGSS(async, cancellationToken);
+    public override ValueTask NegotiateAuthentication(bool async, bool isKerberos, NpgsqlConnector connector, CancellationToken cancellationToken)
+        => connector.AuthenticateGSS(async, isKerberos, cancellationToken);
 
     public override ValueTask<GssEncryptionResult> GSSEncrypt(bool async, bool isRequired, NpgsqlConnector connector, CancellationToken cancellationToken)
         => connector.GSSEncrypt(async, isRequired, cancellationToken);
 
@@ -61,7 +61,8 @@ await AuthenticateSASL(((AuthenticationSASLMessage)msg).Mechanisms, username, as
             case AuthenticationRequestType.GSS:
             case AuthenticationRequestType.SSPI:
                 ThrowIfNotAllowed(requiredAuthModes, msg.AuthRequestType == AuthenticationRequestType.GSS ? RequireAuthMode.GSS : RequireAuthMode.SSPI);
-                await DataSource.IntegratedSecurityHandler.NegotiateAuthentication(async, this, cancellationToken).ConfigureAwait(false);
+                var isKerberos = msg.AuthRequestType == AuthenticationRequestType.GSS;
+                await DataSource.IntegratedSecurityHandler.NegotiateAuthentication(async, isKerberos, this, cancellationToken).ConfigureAwait(false);
                 return;
 
             case AuthenticationRequestType.GSSContinue:
@@ -327,7 +328,7 @@ async Task AuthenticateMD5(string username, byte[] salt, bool async, Cancellatio
         await Flush(async, cancellationToken).ConfigureAwait(false);
     }
 
-    internal async ValueTask AuthenticateGSS(bool async, CancellationToken cancellationToken)
+    internal async ValueTask AuthenticateGSS(bool async, bool isKerberos, CancellationToken cancellationToken)
     {
         var targetName = $"{KerberosServiceName}/{Host}";
         // See https://github.com/postgres/postgres/blob/a0dd0702e464f206b08c99a74cb58809c51aafa5/src/interfaces/libpq/fe-auth.c#L111-L123
@@ -337,15 +338,24 @@ internal async ValueTask AuthenticateGSS(bool async, CancellationToken cancellat
             TargetName = targetName,
             RequireMutualAuthentication = true
         };
+        // If postgres requests GSS, we explicitly ask for Kerberos
+        // Instead of relying on SSPI on windows to pick the correct protocol (Kerberos instead of NTLM)
+        // Otherwise, leave Negotiate to allow SSPI to pick whatever it thinks is correct
+        // This behavior differs from libpq, which prefers SSPI to pick the protocol
+        // But mimics PGJDBC
+        // On UNIX only Kerberos is supported, so no need to differentiate between OSes
+        // TODO: PGJBC has a parameter to force SSPI. Not sure we need something like this.
+        if (isKerberos)
+            clientOptions.Package = "Kerberos";
 
         NegotiateOptionsCallback?.Invoke(clientOptions);
 
         using var authContext = new NegotiateAuthentication(clientOptions);
         var data = authContext.GetOutgoingBlob(ReadOnlySpan<byte>.Empty, out var statusCode)!;
-        if (statusCode != NegotiateAuthenticationStatusCode.ContinueNeeded)
+        if (statusCode is not NegotiateAuthenticationStatusCode.Completed and not NegotiateAuthenticationStatusCode.ContinueNeeded)
         {
             // Unable to retrieve credentials or some other issue
-            throw new NpgsqlException($"Unable to authenticate with GSS: received {statusCode} instead of the expected ContinueNeeded");
+            throw new NpgsqlException($"Unable to authenticate with GSS: received {statusCode} instead of the expected ContinueNeeded or Completed");
         }
         await WritePassword(data, 0, data.Length, async, cancellationToken).ConfigureAwait(false);
         await Flush(async, cancellationToken).ConfigureAwait(false);
 
@@ -637,7 +637,7 @@ internal async ValueTask<GssEncryptionResult> GSSEncrypt(bool async, bool isRequ
                 return GssEncryptionResult.GetCredentialFailure;
             }
 
-            if (statusCode != NegotiateAuthenticationStatusCode.ContinueNeeded)
+            if (statusCode is not NegotiateAuthenticationStatusCode.Completed and not NegotiateAuthenticationStatusCode.ContinueNeeded)
             {
                 // Unable to retrieve credentials
                 // If it's required, throw an appropriate exception
Original file line number	Diff line number	Diff line change
`@@ -637,7 +637,7 @@ internal async ValueTask<GssEncryptionResult> GSSEncrypt(bool async, bool isRequ`
`637`	`637`	`return GssEncryptionResult.GetCredentialFailure;`
`638`	`638`	`}`
`639`	`639`
`640`		`- if (statusCode != NegotiateAuthenticationStatusCode.ContinueNeeded)`
	`640`	`+ if (statusCode is not NegotiateAuthenticationStatusCode.Completed and not NegotiateAuthenticationStatusCode.ContinueNeeded)`
`641`	`641`	`{`
`642`	`642`	`// Unable to retrieve credentials`
`643`	`643`	`// If it's required, throw an appropriate exception`