Re: Custom GINA Using Our Custom CSP

From: Eric Perlin [MS] (ericperl_at_online.microsoft.com)
Date: 10/29/04

  • Next message: Eric Perlin [MS]: "Re: How to debug winlogon blue screen?" 
    Date: Thu, 28 Oct 2004 19:25:48 -0700

    The USB devices in question typically expose themselves as a USB smartcard
    reader with a card that's always inserted.
    As such, it's still a smartcard PKI logon.

    I'm curious though: where do you plan to store the keys required to satisfy
    a PKI logon? 

    -- 
Eric Perlin [MS]
This posting is provided "AS IS" with no warranties, and confers no rights.
---
"David M. Hunter" <skipper_dhunter@yahoo.com> wrote in message
news:OAiaomEuEHA.1404@TK2MSFTNGP11.phx.gbl...
> We have our own custom CSP and we want to write a GINA such that we can
use
> PKI keys and certs in our CSP as part of the Windows logon.  We've been
> working on this for three weeks and I'm looking for a reality check that
we
> are heading in the correct direction.
>
> Basically we want to do a PKI-based logon (user doesn't type in a
password)
> to a Windows domain.  Based on the documentation we have found the best
> approach we can see is to simulate a smart card logon.  We call
WlxSasNotify
> with the WLX_SAS_TYPE_SC_INSERT.  Then later when we hook
WlxLoggedOutSAS()
> we are calling LsaLogonUser() with type 'Interactive' and the
> AuthenticationInformation (the 5th arg) is a copy of the
> KERB_SMART_CARD_LOGON structure.   The KERB_SMART_CARD_LOGON is not
> documented in MSDN, but it looks like the only structure we can pass to
> LsaLogonUser() passing CSP or Certificate information.  Currently, we are
> getting an error that the Kerberos Authentication Package is rejecting our
> AuthenticationInformation as incorrectly formatted.
>
> Does this sound right to anyone or are we way off base.  I think this is
> possible because some companies sell little USB tokens that implement PKI
> features and claim to support Windows logon.  Again, we have been hacking
on
> this for three weeks and given our lack of success I'm starting to
question
> our approach.  Can anyone give an overview of how best to do a custom
> PKI-based (no password and not a smart card) logon to a Windows domain?
>
> Thank you very much for any pointers you can provide.
>
> David
>
>
>
  • Next message: Eric Perlin [MS]: "Re: How to debug winlogon blue screen?"

    Relevant Pages

    • Re: LogOnUser with Smart Card Credentials
      ... from the Windows logon dialog and serves our application only). ... call LogonUser with the credentials provided in the dialog. ... The card needs to be present to verify the PIN and also to obtain a token. ...
      (microsoft.public.platformsdk.security)
    • Re: LogOnUser with Smart Card Credentials
      ... from the Windows logon dialog and serves our application only). ... call LogonUser with the credentials provided in the dialog. ... The card needs to be present to verify the PIN and also to obtain a token. ...
      (microsoft.public.platformsdk.security)
    • Re: Windows logon through smart card.
      ... A real PKINIT SC logon uses a private key on the card. ... architecture and to enable smart card logon we have to hook msgina. ... If its a certificate based logon then how ...
      (microsoft.public.platformsdk.security)
    • RE: GINA - exception in winlogon
      ... method for smart card logon in order to access system but ... certificate logon to unlonk the system, so it produces a new authentication ... our idea is to unlock the system only via smart card PIN authentication, ...
      (microsoft.public.platformsdk.security)
    • Re: Remove domain from log in to drop down list
      ... You can't hide the root domain from being listed in the Log on to field. ... The only real solution to make the domain list hidden at logon is to Require ... Smart Cards for interactive logon. ... card" in GPO. ...
      (microsoft.public.windows.server.active_directory)