Custom Windows Authentication Package

问题:

So, here is the scenario. I am developing a logon system in windows 7. I have created a Credential Provider, containing one Credential. The Credential has three input fields, username, password, and PIN.

From what I have learned the documentation (CMIIW) is that when we fill in the fields and click logon, WINLOGON will retrieve the username and password, and send it to LSA by calling LSALogonUser() to authenticate. LSA then will try negotiate with Authentication Package KERBEROS (for remote logon) or MSV1_0 (for local logon).

Assume only the local scenario for now, the username and password will be passed to MSV1_0, and be checked with those in SAM database. Now the thing is, I don't want it to be checked with SAM database. Lets say I have a file C:\users.txt which contains entries as triplets: {username ; password ; PIN}. All the username here is an existing user in windows. How do I make it so that the authentication is following my way (checking the file C:\users.txt.

If I'm not mistaken, we can create our own Authentication Package that 'wraps' the MSV1_0. Do you guys have a sample code for that? Or is there another more appropriate way?

Thank you, I appreciate your helps very much.

回答1:

I do haven't done any work with the Windows Logon since GINA where left in the past, as PKI became the de-facto standard for credential storage. But...

Your question asked for some sample code, here is a full description

http://msdn.microsoft.com/en-gb/magazine/cc163489.aspx#S4

This is a little old, so it refers to smart cards, perhaps when you say token you are still talking about a smart card, but I suspect you mean a USB drive. However, if you attempting this level of development it should be fairly simple to swap code for Smart Card Read/Write and USB Read/Write.

回答2:

You could try samples from windows sdk. There are sub authentication packages which are simpler to implement than full AP.

回答3:

You can always write your own code that checks input with your data in database, there is many ways to do that. This is a video about smart and dull ways to do that.

and this is page about Custom Windows Authentication Package but I haven't really check that