AcquireCredentialsHandle failing with SEC_E_INTERNAL_ERROR for domain logon

• Previous message: Mauro Iorio: "Re: Can't call WlxSASNotify in a separate thread! Alternative ways?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Sun, 19 Dec 2004 11:51:23 -0000

Hi,

I am trying to add client Authentication to an SSL connection.

I have the following code (taken from an example) to read the client
certificate from the certificate store and create the client credentials for
SCHANNEL.

However, the AcquireCredentialHandle() call works fine when I'm logged onto
a local account on my PC, but always fails with SEC_E_INTERNAL_ERROR when
I'm logged in through a domain controller. I am able read the certificate
from the store OK in both cases.

Does anyone know how I can get this working when logging in through a
domain?

Thanks,

Colin

---- Code Sample -----

bool SSLImplementation::createCredentials(LPCSTR pszUserName)
{
    TimeStamp tsExpiry;
    SECURITY_STATUS Status;

    char szErr[200];

    PCCERT_CONTEXT pCertContext = NULL;

    //
    // If a user name is specified, then attempt to find a client
    // certificate. Otherwise, just create a NULL credential.
    //

    if(pszUserName)
    {
        // Find client certificate. Note that this sample just searchs for a
        // certificate that contains the user name somewhere in the subject
name.
        // A real application should be a bit less casual.
        pCertContext = CertFindCertificateInStore(g_handler.m_hMyCertStore,
                                                  X509_ASN_ENCODING,
                                                  0,
                                                  CERT_FIND_SUBJECT_STR_A,
                                                  pszUserName,
                                                  NULL);
        if(pCertContext == NULL)
        {
            sprintf(szErr,"Error 0x%x returned by
CertFindCertificateInStore\n", GetLastError());
            g_handler.setLastError(szErr);
            return false;
        }
    }

    //
    // Build Schannel credential structure.
    ZeroMemory(&m_SchannelCred, sizeof(m_SchannelCred));

    m_SchannelCred.dwVersion = SCHANNEL_CRED_VERSION;
    if(pCertContext)
    {
        m_SchannelCred.cCreds = 1;
        m_SchannelCred.paCred = &pCertContext;
    }

    m_SchannelCred.grbitEnabledProtocols = SP_PROT_SSL3_CLIENT;

    //
    // Create an SSPI credential.
    //
    Status = g_handler.m_SecurityFunc.AcquireCredentialsHandleA(
                        NULL, // Name of principal
                        UNISP_NAME_A,
                        SECPKG_CRED_OUTBOUND, // Flags indicating use
                        NULL, // Pointer to logon ID
                        &m_SchannelCred, // Package specific data
                        NULL, // Pointer to GetKey() func
                        NULL, // Value to pass to GetKey()
                        &m_hCred, // (out) Cred Handle
                        &tsExpiry); // (out) Lifetime (optional)
    if(Status != SEC_E_OK)
    {
        sprintf(szErr,"Error 0x%x returned by AcquireCredentialsHandle\n",
Status);
        g_handler.setLastError(szErr);
        return false;
    }

    //
    // Free the certificate context. Schannel has already made its own copy.
    //

    if(pCertContext)
    {
        CertFreeCertificateContext(pCertContext);
    }

    return true;
}

• Previous message: Mauro Iorio: "Re: Can't call WlxSASNotify in a separate thread! Alternative ways?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]