CODEWITHSUNDEEP
winapikerberossspi
Ian Boyd
Ian Boyd

Reputation: 256951

How to get the authority when using SSPI?

When you use the Security Support Provider Interface (SSPI) API to validate a user's credentials, the server ends up with a security context handle.

You can then use the QueryContextAttributes function to query for information about the security context handle:

When i use SSPI to validate my credentials, the server gets a set of information about me, one of the items fails:

Credential authority

I want to know the authority who validated (or vouched for the cached) credentials.

Except calling QueryContextAttributes (and QueryContextAttributesEx) with SECPKG_ATTR_AUTHORITY fails with the error:

// MessageId: SEC_E_UNSUPPORTED_FUNCTION
//
// MessageText:
//
//  The function requested is not supported
//

SEC_E_UNSUPPORTED_FUNCTION       = HRESULT($80090302);

What's doing?

I can find it using the command line:

C:\Users\Ian>SET

LOGONSERVER=\\HYDROGEN

But i'm using APIs.

Background: How SSPI works

SSPI was designed as a generic wrapper around different security algorithms. The way to use the API is pretty simple:

Both sides keep going back and forth, until the function stops returning a blob that needs to be sent to the other side:

enter image description here

And so the with SSPI you do this ping-ponging back and forth until you're told to stop. And so they were able to shoe-horn every authentication scheme into that ping-pong-until-told-to-stop high level abstraction.

And how do you transmit the blobs?

You transmit the blobs over whatever communication channel you're using. You can use e-mail, Discord, SMS, morse code, smoke signals.

If you're talking to a remote server over TCP, then you'd probably use TCP:

// Open connection to server
sockConnect(162.210.196.166, 1433);

blob = null;

Boolean bContinue = InitializeSecurityContext(ref blob);

while (bContinue)
{
   sockWrite(blob); //send the blob to the server

   blob = sockRead(); //wait for the server to return a blob 

   bContinue = InitializeSecurityContext(ref blob);
}

If you're doing it over http:

blob = null;
Boolean bContinue = InitializeSecurityContext(ref blob);

while (bContinue)
{
    http = new HttpRequest("http://4chan.org/default.aspx");
    http.AddHeader("X-SSPI-Blob", blob.ToBase64());
    http.Send();

    blob = http.ReasponseHeader["X-SSPI-Blob"];
    if (blob.IsEmpty())
       break;

    bContinue = InitializeSecurityContext(ref blob);
}

You can even send them over carrier pigeon if you want!

Bonus Reading

SSPI is the name of the Windows implementation of RFC4121

Generic Security Service Application Program Interface (GSS-API)

Bonus Bonus

Upvotes: 1

Views: 1144

Answers (0)

Related Questions