Re: "LsaLogonUser" method to log a user on to the local computer using Kerberos ticket

On May 16, 10:58 pm, MADHUKAR ROCKER <earthlyh...@xxxxxxxxx> wrote:
Hello,

In windows we have "LogonUser" function which attempts to log a user
on to the local computer.
We specify the user with a user name and domain and authenticate the
user with a plaintext password.
If the function succeeds, you receive a handle to a token that
represents the logged-on user.
You can then use this token handle to impersonate the specified
user.

Is there any Windows API to LogonUser/impersonate user using Kerberos
ticket without providing password?
This is required for Single Sign-on feature.

I came across one Windows API "LsaLogonUser" which takes Kerberos
ticket.
But i am not sure whether this is the right API to use.

Can i use "LsaLogonUser" method to log a user on to the local computer
using Kerberos ticket?

Does anyone have sample code for "LsaLogonUser" method?

Thanks
MADHUKAR

Yes, assuming Windows 2003 or better. Google "S4U Kerberos" and you'll
find references to "Protocol Transition". This is a way to generate a
Kerb ticket for a user without their password. You use KERB_S4U_LOGON
with LsaLogonUser.

HTH,
Dave

.

Relevant Pages