How to write a KSP to hook up into KERB_CERTIFICATE_LOGON

一个人想着一个人 提交于 2020-01-05 08:03:47

问题


Hi all I've written a custom credentialprovider that works fine when using username/password as credential, the password is transferred via bluetooth. After all it was not that difficult as the documentation tells you what interfaces to implement.

Now I want to change the credentials to use certificates instead. I see that I should use the KERB_CERTIFICATE_LOGON structure for this. Diving deeper into the topic I found that I should implement a custom key storage provider as described in this article by microsoft. And that's the point where I am lost. Perhaps I am to silly to search for the right documentation but I just cannot find which interfaces I have to implement to have a KSP that I can refer to in the CspData-field of the KERB_CERTIFICATE_LOGON structure. I just find a bunch of methods and a quick search for NCRYPT_CERTIFICATE_PROPERTY (mentioned in the above linked article) revealed amazing two results in google.

I have found this SO-question that will help me connecting credentialprovider and KSP when I have one, but it does not explain how to write the KSP. :-(

Can anybody guide me where to find information or show a short sample of a KSP used in a similar scenario (just the method declarations, and how to use the resulting KSP in the call to KERB_CERTIFICATE_LOGON)?


回答1:


This Microsoft Cryptographic Provider Development Kit has a good sample of the KSP.

The only thing you need to do in addition to this sample is implement SmartCardKeyCertificate property. The code will be something like this:

SECURITY_STATUS
WINAPI
KSPGetKeyProperty(
__in    NCRYPT_PROV_HANDLE hProvider,
__in    NCRYPT_KEY_HANDLE hKey,
__in    LPCWSTR pszProperty,
__out_bcount_part_opt(cbOutput, *pcbResult) PBYTE pbOutput,
__in    DWORD   cbOutput,
__out   DWORD * pcbResult,
__in    DWORD   dwFlags)
{

    ...

    if (wcscmp(pszProperty, NCRYPT_CERTIFICATE_PROPERTY) == 0)
    {
        dwProperty = SAMPLEKSP_CERTIFICATE_PROPERTY;
        cbResult = GetCertificateSize(); //the size of the certificate that is associated with the key
    }

    *pcbResult = cbResult;
    if(pbOutput == NULL)
    {
        Status = ERROR_SUCCESS;
        goto cleanup;
    }

    if(cbOutput < *pcbResult)
    {
         Status = NTE_BUFFER_TOO_SMALL;
         goto cleanup;
    }

    if (wcscmp(pszProperty, NCRYPT_CERTIFICATE_PROPERTY) == 0)
    {
        CopyMemory(pbOutput, crt, sizeof(crt));
    }


    switch(dwProperty)
    {
    case SAMPLEKSP_CERTIFICATE_PROPERTY:
        CopyMemory(pbOutput, GetCertificate(), cbResult); //Copy to pbOutput the certificate in binary form 
        break;

    ...

    }

    ...

}

After you implement KSP and register it, your CredentialProvider can interact with it:

HRESULT MyCredential::GetSerialization(
    CREDENTIAL_PROVIDER_GET_SERIALIZATION_RESPONSE* pcpgsr,
    CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION* pcpcs,
    PWSTR* ppwszOptionalStatusText,
    CREDENTIAL_PROVIDER_STATUS_ICON* pcpsiOptionalStatusIcon
    )
{

    ...

    ULONG ulAuthPackage;
    HRESULT hr = RetrieveNegotiateAuthPackage(&ulAuthPackage);
    ConstructAuthInfo(&pcpcs->rgbSerialization, &pcpcs->cbSerialization);

    if (SUCCEEDED(hr))
    {
        pcpcs->ulAuthenticationPackage = ulAuthPackage;
        pcpcs->clsidCredentialProvider = CLSID_MyCredentialProvider;

        // At this point the credential has created the serialized credential used for logon
        // By setting this to CPGSR_RETURN_CREDENTIAL_FINISHED we are letting logonUI know
        // that we have all the information we need and it should attempt to submit the 
        // serialized credential.
        *pcpgsr = CPGSR_RETURN_CREDENTIAL_FINISHED;
    }

    return hr;
}

HRESULT RetrieveNegotiateAuthPackage(ULONG * pulAuthPackage)
{
    HRESULT hr = S_OK;
    HANDLE hLsa = NULL;

    NTSTATUS status = LsaConnectUntrusted(&hLsa);
    if (SUCCEEDED(HRESULT_FROM_NT(status)))
    {

        ULONG ulAuthPackage;
        LSA_STRING lsaszKerberosName;
        LsaInitString(&lsaszKerberosName, MICROSOFT_KERBEROS_NAME_A);
        status = LsaLookupAuthenticationPackage(hLsa, &lsaszKerberosName, &ulAuthPackage);
        if (SUCCEEDED(HRESULT_FROM_NT(status)))
        {
            *pulAuthPackage = ulAuthPackage;
            hr = S_OK;
        }
        else
        {
            hr = HRESULT_FROM_NT(status);
        }
        LsaDeregisterLogonProcess(hLsa);
    }
    else
    {
        hr = HRESULT_FROM_NT(status);
    }

    return hr;
}

void ConstructAuthInfo(LPBYTE* ppbAuthInfo, ULONG *pulAuthInfoLen)
{
    WCHAR szCardName[] = L""; // no card name specified but you can put one if you want
    WCHAR szContainerName[] = L"my_key_name";
    WCHAR szReaderName[] = L"";
    WCHAR szCspName[] = L"My Key Storage Provider";
    WCHAR szPin[] = L"11111111";
    ULONG ulPinByteLen = wcslen(szPin) * sizeof(WCHAR);
    WCHAR szUserName[] = L"user";
    ULONG ulUserByteLen = wcslen(szUserName) * sizeof(WCHAR);
    WCHAR szDomainName[] = L"testdomain.com";
    ULONG ulDomainByteLen = wcslen(szDomainName) * sizeof(WCHAR);
    LPBYTE pbAuthInfo = NULL;
    ULONG  ulAuthInfoLen = 0;
    KERB_CERTIFICATE_LOGON *pKerbCertLogon;
    KERB_SMARTCARD_CSP_INFO *pKerbCspInfo;
    LPBYTE pbDomainBuffer, pbUserBuffer, pbPinBuffer;
    LPBYTE pbCspData;
    LPBYTE pbCspDataContent;

    ULONG ulCspDataLen = sizeof(KERB_SMARTCARD_CSP_INFO)-sizeof(TCHAR)+
        (wcslen(szCardName) + 1) * sizeof(WCHAR)+
        (wcslen(szCspName) + 1) * sizeof(WCHAR)+
        (wcslen(szContainerName) + 1) * sizeof(WCHAR)+
        (wcslen(szReaderName) + 1) * sizeof(WCHAR);

    ulAuthInfoLen = sizeof(KERB_CERTIFICATE_LOGON)+
        ulDomainByteLen + sizeof(WCHAR)+
        ulUserByteLen + sizeof(WCHAR)+
        ulPinByteLen + sizeof(WCHAR)+
        ulCspDataLen;

    pbAuthInfo = (LPBYTE)CoTaskMemAlloc(ulAuthInfoLen);
    ZeroMemory(pbAuthInfo, ulAuthInfoLen);

    pbDomainBuffer = pbAuthInfo + sizeof(KERB_CERTIFICATE_LOGON);
    pbUserBuffer = pbDomainBuffer + ulDomainByteLen + sizeof(WCHAR);
    pbPinBuffer = pbUserBuffer + ulUserByteLen + sizeof(WCHAR);
    pbCspData = pbPinBuffer + ulPinByteLen + sizeof(WCHAR);

    memcpy(pbDomainBuffer, szDomainName, ulDomainByteLen);
    memcpy(pbUserBuffer, szUserName, ulUserByteLen);
    memcpy(pbPinBuffer, szPin, ulPinByteLen);

    pKerbCertLogon = (KERB_CERTIFICATE_LOGON*)pbAuthInfo;

    pKerbCertLogon->MessageType = KerbCertificateLogon;
    pKerbCertLogon->DomainName.Length = (USHORT)ulDomainByteLen;
    pKerbCertLogon->DomainName.MaximumLength = (USHORT)(ulDomainByteLen + sizeof(WCHAR));
    pKerbCertLogon->DomainName.Buffer = (PWSTR)(pbDomainBuffer-pbAuthInfo);
    pKerbCertLogon->UserName.Length = (USHORT)ulUserByteLen;
    pKerbCertLogon->UserName.MaximumLength = (USHORT)(ulUserByteLen + sizeof(WCHAR));
    pKerbCertLogon->UserName.Buffer = (PWSTR)(pbUserBuffer-pbAuthInfo);
    pKerbCertLogon->Pin.Length = (USHORT)ulPinByteLen;
    pKerbCertLogon->Pin.MaximumLength = (USHORT)(ulPinByteLen + sizeof(WCHAR));
    pKerbCertLogon->Pin.Buffer = (PWSTR)(pbPinBuffer-pbAuthInfo);

    pKerbCertLogon->CspDataLength = ulCspDataLen;
    pKerbCertLogon->CspData = (PUCHAR)(pbCspData-pbAuthInfo);

    pKerbCspInfo = (KERB_SMARTCARD_CSP_INFO*)pbCspData;
    pKerbCspInfo->dwCspInfoLen = ulCspDataLen;
    pKerbCspInfo->MessageType = 1;
    pKerbCspInfo->KeySpec = CERT_NCRYPT_KEY_SPEC;

    pKerbCspInfo->nCardNameOffset = 0;
    pKerbCspInfo->nReaderNameOffset = pKerbCspInfo->nCardNameOffset + wcslen(szCardName) + 1;
    pKerbCspInfo->nContainerNameOffset = pKerbCspInfo->nReaderNameOffset + wcslen(szReaderName) + 1;
    pKerbCspInfo->nCSPNameOffset = pKerbCspInfo->nContainerNameOffset + wcslen(szContainerName) + 1;

    pbCspDataContent = pbCspData + sizeof(KERB_SMARTCARD_CSP_INFO)-sizeof(TCHAR);
    memcpy(pbCspDataContent + (pKerbCspInfo->nCardNameOffset * sizeof(WCHAR)), szCardName, wcslen(szCardName) * sizeof(WCHAR));
    memcpy(pbCspDataContent + (pKerbCspInfo->nReaderNameOffset * sizeof(WCHAR)), szReaderName, wcslen(szReaderName) * sizeof(WCHAR));
    memcpy(pbCspDataContent + (pKerbCspInfo->nContainerNameOffset * sizeof(WCHAR)), szContainerName, wcslen(szContainerName) * sizeof(WCHAR));
    memcpy(pbCspDataContent + (pKerbCspInfo->nCSPNameOffset * sizeof(WCHAR)), szCspName, wcslen(szCspName) * sizeof(WCHAR));

    *ppbAuthInfo = pbAuthInfo;
    *pulAuthInfoLen = ulAuthInfoLen;
}

There are two main things in this code:

  1. For interacting with the KSP, pKerbCspInfo->KeySpec must be CERT_NCRYPT_KEY_SPEC.
  2. For proper structure serialization, according to this answer:

    pKerbCertLogon->DomainName.Buffer = (PWSTR)(pbDomainBuffer-pbAuthInfo); pKerbCertLogon->UserName.Buffer = (PWSTR)(pbUserBuffer-pbAuthInfo); pKerbCertLogon->Pin.Buffer = (PWSTR)(pbPinBuffer-pbAuthInfo); pKerbCertLogon->CspData = (PUCHAR)(pbCspData-pbAuthInfo);

Also the domain controller should issue the certificate with "Kerberos Authentication" template.



来源:https://stackoverflow.com/questions/41869313/how-to-write-a-ksp-to-hook-up-into-kerb-certificate-logon

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!