Re: Accessing security information from an authentication provider
- From: Corinna Vinschen <corinna@xxxxxxxxxxxxxxxx>
- Date: Thu, 10 Jul 2008 17:34:44 +0000 (UTC)
Corinna Vinschen wrote:
But, here's the problem I have with ConvertAuthDataToToken. It sounds a
nice idea to call it, and when it returns, you have a token. But...
what next?
The call to LsaApLogonUser has no way to return the token to the
caller. Instead, there's the TokenInformation pointer which has to
be filled with a LSA_TOKEN_INFORMATION_V2 structure which in turn
is used to create a token by MSV1_0. And *that* token is returned
to the calling logon process. What's suppsoed to happen with the token
returned by ConvertAuthDataToToken?
In the meantime it occured to me how to transmit the token to the
calling logon process and I hacked happily away. Alas, the result is
just disappointing.
For some reason GetAuthDataForUser() only works for local machine
accounts. I have to give the plain username to the function. If I try
to get the auth data for a domain account by using the domain\username
syntax and SecNameSamCompatible as type, or using the
username@xxxxxxxxxx syntax and SecNameFlat as type, I'm invariably
getting a return code of STATUS_NO_SUCH_USER from GetAuthDataForUser().
Even when running on a DC, it only works half. The token returned by
ConvertAuthDataToToken() does not contain the groups not defined in the
local SAM, and the credentials required to access network resources are
*still* missing.
If you only need a machine local account and no network credentials,
it's an easy solution, provided you have a way to transmit the results
to the calling logon application. Personally I called DuplicateHandle()
on the token and transmitted the new handle value in the profile buffer.
If you need to authenticate against AD or if you need network
credentials, you're still stuck like me.
Hello? Microsoft? Help? Please?
Corinna
--
Corinna Vinschen
Cygwin Project Co-Leader
Red Hat
.
- Follow-Ups:
- References:
- Accessing security information from an authentication provider
- From: Chris Smith
- Re: Accessing security information from an authentication provider
- From: Chris Smith
- Re: Accessing security information from an authentication provider
- From: Joe Kaplan
- Re: Accessing security information from an authentication provider
- From: Corinna Vinschen
- Accessing security information from an authentication provider
- Prev by Date: Re: Accessing security information from an authentication provider
- Next by Date: Re: Accessing security information from an authentication provider
- Previous by thread: Re: Accessing security information from an authentication provider
- Next by thread: Re: Accessing security information from an authentication provider
- Index(es):
Relevant Pages
|
