jstedfast/MailKit · error · ArgumentNullException

challenge

Error message

challenge

What it means

The NtlmAuthenticateMessage constructor throws ArgumentNullException when the challenge parameter is null. The server's CHALLENGE (Type2) message is required to compute the NTLM response, so it is a mandatory argument.

Solutions

1. Obtain a valid NtlmChallengeMessage (e.g. new NtlmChallengeMessage(serverResponse, 0)) before constructing the authenticate message.
2. Null-check the challenge before calling the constructor.
3. Verify the server actually sent a Type2 challenge and that it parsed successfully.

Example fix

// before
var auth = new NtlmAuthenticateMessage(negotiate, challenge, user, pass, domain, ws); // challenge is null
// after
challenge = new NtlmChallengeMessage(challengeBytes, 0);
var auth = new NtlmAuthenticateMessage(negotiate, challenge, user, pass, domain, ws);

if (challenge == null) throw new InvalidOperationException("Server did not send an NTLM Type2 challenge.");
var auth = new NtlmAuthenticateMessage(negotiate, challenge, userName, password, domain, workstation);

static bool CanBuildAuthMessage(NtlmNegotiateMessage n, NtlmChallengeMessage c) => n != null && c != null;

try {
	auth = new NtlmAuthenticateMessage(negotiate, challenge, userName, password, domain, workstation);
} catch (ArgumentNullException ex) when (ex.ParamName == "challenge") {
	// server response missing; abort NTLM and fall back to another auth mechanism
	fallbackAuth();
}

When it happens

Trigger: Calling new NtlmAuthenticateMessage(negotiate, null, ...) — e.g. the server never sent a Type2 message or parsing of the challenge message returned null.

Common situations: Handshake against a non-conformant server that skipped the CHALLENGE step; code paths where the Type2 parse failed and null was propagated.

Related errors

• negotiate
• userName
• password
• value
• message

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/1314414ca2bbefa7. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/Ntlm/NtlmAuthenticateMessage.cs:48

using System.Text;
using System.Diagnostics.CodeAnalysis;

namespace MailKit.Security.Ntlm {
	class NtlmAuthenticateMessage : NtlmMessageBase
	{
		static readonly byte[] Z16 = new byte[16];

		readonly NtlmNegotiateMessage? negotiate;
		readonly NtlmChallengeMessage? challenge;
		byte[] clientChallenge;

		public NtlmAuthenticateMessage (NtlmNegotiateMessage negotiate, NtlmChallengeMessage challenge, string userName, string password, string domain, string workstation) : base (3)
		{
			if (negotiate == null)
				throw new ArgumentNullException (nameof (negotiate));

			if (challenge == null)
				throw new ArgumentNullException (nameof (challenge));

			if (userName == null)
				throw new ArgumentNullException (nameof (userName));

			if (password == null)
				throw new ArgumentNullException (nameof (password));

			clientChallenge = NtlmUtils.NONCE (8);
			this.negotiate = negotiate;
			this.challenge = challenge;

			if (!string.IsNullOrEmpty (domain)) {
				Domain = domain;
			} else if ((challenge.Flags & NtlmFlags.TargetTypeDomain) != 0) {
				// The server is domain-joined, so the TargetName will be the domain.
				Domain = challenge.TargetName ?? string.Empty;
			} else if (challenge.TargetInfo != null) {
				// The server is not domain-joined, so the TargetName will be the machine name of the server.

View on GitHub (pinned to 9d3859a785)