Custom Windows Authentication Package

Question

So, here is the scenario. I am developing a logon system in windows 7. I have created a Credential Provider, containing one Credential. The Credential has three input fields, username, password, and PIN.

From what I have learned the documentation (CMIIW) is that when we fill in the fields and click logon, WINLOGON will retrieve the username and password, and send it to LSA by calling LSALogonUser() to authenticate. LSA then will try negotiate with Authentication Package KERBEROS (for remote logon) or MSV1_0 (for local logon).

Assume only the local scenario for now, the username and password will be passed to MSV1_0, and be checked with those in SAM database. Now the thing is, I don't want it to be checked with SAM database. Lets say I have a file C:\users.txt which contains entries as triplets: {username ; password ; PIN}. All the username here is an existing user in windows. How do I make it so that the authentication is following my way (checking the file C:\users.txt.

If I'm not mistaken, we can create our own Authentication Package that 'wraps' the MSV1_0. Do you guys have a sample code for that? Or is there another more appropriate way?

Thank you, I appreciate your helps very much.

Castello

Have you ever solved this problem? I am trying to do something similar where the authentication should be based on a username and a number from an OTP-token – Leverick

are you still stuck on this? I wrote a windows GINA extension some years back, and I can dig up the code if it's of any help to you. Cheers, Con – Bradney

Windows checks your credentials against its Local Security Authority because it wants to know whether IT should trust you. Bypassing its checking with your own insecure credentials in a text file would compromise Windows's security so I doubt it will let you do so. What are you actually trying to achieve? – Traci

@jeff There's a technet article about using OTP tokens with remote Windows logon. It's a bit convoluted (and only works with Windows 7 and later) but may help. technet.microsoft.com/en-us/library/gg637807(v=ws.10).aspx – Traci

@Traci What I ultimately want for my home computer: when I am at home a username + password should be enough en when I am outside and use Remote Desktop I would like a verification by username+OTP-token. I guess I will have to settle for username+password+OTP-token. The article is an interesting read but I am still at Vista – Leverick

Answer 1

I do haven't done any work with the Windows Logon since GINA where left in the past, as PKI became the de-facto standard for credential storage. But...

Your question asked for some sample code, here is a full description

http://msdn.microsoft.com/en-gb/magazine/cc163489.aspx#S4

This is a little old, so it refers to smart cards, perhaps when you say token you are still talking about a smart card, but I suspect you mean a USB drive. However, if you attempting this level of development it should be fairly simple to swap code for Smart Card Read/Write and USB Read/Write.

Assyriology

Answer 2

You could try samples from windows sdk. There are sub authentication packages which are simpler to implement than full AP.

Croatia

Answer 3

You can always write your own code that checks input with your data in database, there is many ways to do that. This is a video about smart and dull ways to do that.

and this is page about Custom Windows Authentication Package but I haven't really check that

Dichlorodifluoromethane