SSPI/NTLM between native code and managed code fails for Windows 2


I have an appliction that uses C++/CLI code for the client side of an NTLM
exchange, and native C++ code for the server side.

The server and client code run on different machines and use TCP/IP to throw
the "token" back and forth until authentication occurs.

This works with no problems under Windows 2003. And has worked for about a
year for us with no problems. However, under Windows 2008, the authentication
has stopped working *only* when C++/CLI code is interacting with native code.
Doesn't matter which machine is the target or which machine is the client.

The error code I am getting back from the server is: 0x80090308 (The token
supplied to the function is invalid). Also, AcceptSecurityContext(...)
returns: ASC_RET_THIRD_LEG_FAILED in the contextattributes.

The strange thing is, NTLM authentication still works if both the apps are
native (i.e. pure C++).

Actually, the be more accurate: a C# app calls into a C++/CLI native wrapper
library, that performs the NTLM authentication. The C# app is an MMC app.

NTLM
C# --> C++/CLI <------> Native C++ (Does not work)

NTLM
native C++ <-------> native C++ (works)


Under Windows 2003, there has never been a problem for over a year.

Question:

Can anyone think of a reason why this could be? I am totally mystified. Is
there anyway to emit more information about why the authentication failed.

Could managed code cause this kind of problem?

Thanks,

Jenny.






--
C/C++ Software Engineer

.

Relevant Pages

  • Re: WCF security advice (and clarification) needed
    ... You, the client, resolve the foo.mycompany.com hostname within your ... TCP/IP) with that ticket as the security token. ... There are two parties participating in a security scenario, the server ... HTTP supports other authentication ...
    (microsoft.public.dotnet.framework.webservices)
  • Re: Integrated Windows Authentication Timeout?
    ... Do you see anything different for the NTLM requests? ... You might consider enabling protocol transition authentication since you are ... Joe Kaplan-MS MVP Directory Services Programming ... server. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: SSPI Kerberos for delegation
    ... We want the authentication to happen without providing credentials ... But SSPI while authenticating from the client to the server can do mutual ...
    (comp.protocols.kerberos)
  • Re: Aironet 1200/Radius Help Needed
    ... I just fired up a W2003 Advanced Server so that I can take ... >> IAS servers (do I need a separate certificate for the secondary IAS ... >> of authentication since it involves just installing the certificate on ... >between the AP and the client. ...
    (microsoft.public.internet.radius)
  • Re: Integrated Windows Authentication Timeout?
    ... Is it possible that a different host name is being used for one of the subsequent requests that would break Kerberos auth? ... If you have "Negotiate" authentication set in the metabase, then this can still negotiate down to NTLM if for some reason the protocol thinks that Kerberos is unavailable. ... server. ...
    (microsoft.public.dotnet.framework.aspnet.security)