|
Posted by =?Utf-8?B?dGhlX21hcnNobWFu?= on July 28, 2005, 4:46 am
If you were Registered and logged in, you could reply and use other advanced thread options
We have been trying to gain a detailed understanding of what SSPI does when
authentication fails. Unfortunately while much documentation exists for how
ti works when it all works, the documentation on what happens when things go
wrong is almost non-existent!
For example, take the scenario where the client initializes a context for a
service with the SPN of "userA@domain.com". However the service is actually
running as
"userB@domain.com".
On the first call to AcceptSecurityContext, when the client's first blob is
passed in, SSPI returns SEC_I_CONTINUE_NEEDED. Shouldn't it return a failure
code since the ticket embedded in the security blob (token) is not encrypted
with a key it can understand?
We've also noticed the behaviour differs between an initial logon and once
the workstation has been locked and unlocked.
On an initial login:
AcquireCredentialsHandle (client side) - SEC_E_OK
AcquireCredentialsHandle (server side) - SEC_E_OK
InitializeSecurityContext - SEC_I_CONTINUE_NEEDED -> Send token to server
AcceptSecurityContext - SEC_I_CONTINUE_NEEDED -> Send token to client
InitializeSecurityContext - SEC_I_CONTINUE_NEEDED -> Send token to server
AcceptSecurityContext - SEC_I_CONTINUE_NEEDED -> Send token to client
InitializeSecurityContext - SEC_E_WRONG_PRINCIPAL
After locking/unlocking the workstation:
AcquireCredentialsHandle (client side) - SEC_E_OK
AcquireCredentialsHandle (server side) - SEC_E_OK
InitializeSecurityContext - SEC_I_CONTINUE_NEEDED -> Send token to server
AcceptSecurityContext - SEC_I_CONTINUE_NEEDED -> Send token to client
InitializeSecurityContext - SEC_E_LOGON_DENIED
Where is the behaviour different after the lock/unlock and why the extra
roundtrip in the initial logon case?
Any enlightment would be greatly appreciated given the black-box nature of
SSPI :)
We are running a W2K3 with SP1 running in W2K+ mode for the Domain
controller and WinXP with SP2 for the workstations.
| 
Yahoo! 
Google 
Windows Live 
del.icio.us 
digg 
Netscape 
XML site map