Very Computer

by **Claude Quéze** » Thu, 20 Jul 2000 04:00:00

Im porting a client/server application to Unix from Win32. Most of the
code is standard C++ so there is no challenge. The Win32 code uses the
following calls to validate user credentials:

AcquireCredentialsHandle()
InitializeSecurityContext()
AcceptSecurityContext()

What are the equivalent (similar) UNIX calls or what is the way to
accomplish this on UNIX?

--

anti-spam: replace corba by com in private replies

by **David Schwart** » Thu, 20 Jul 2000 04:00:00

> Im porting a client/server application to Unix from Win32. Most of the
> code is standard C++ so there is no challenge. The Win32 code uses the
> following calls to validate user credentials:

> AcquireCredentialsHandle()
> InitializeSecurityContext()
> AcceptSecurityContext()

> What are the equivalent (similar) UNIX calls or what is the way to
> accomplish this on UNIX?

What do you mean by "validate user credentials"? Is this a library
trying to decide who is calling it? Or do you have a username/password
and you want to find out if they are correct?

DS

by **Claude Quéze** » Fri, 21 Jul 2000 04:00:00

> What do you mean by "validate user credentials"? Is this a library
> trying to decide who is calling it? Or do you have a username/password
> and you want to find out if they are correct?

> DS

On Win32, the client initiates authentication with the server by using a
security support provider (Windows NT Lan Mananager Security Support Provider
in this case) and calling AcquireCredentialsHandle(). The client then initates
a series of calls to InitializeSecurityContext() passing and receiving buffers
from the server. On the server side a similar call to
AcquireCredentialsHandle() is followed by a series of calls to
AcceptSecurityContext() recieiving and passing buffers to the client. The
client never obtains a username or a password explicitly.

Claude

--

anti-spam: replace corba by com in private replies

by **Barry Margoli** » Fri, 21 Jul 2000 04:00:00

>> What do you mean by "validate user credentials"? Is this a library
>> trying to decide who is calling it? Or do you have a username/password
>> and you want to find out if they are correct?

>> DS

>On Win32, the client initiates authentication with the server by using a
>security support provider (Windows NT Lan Mananager Security Support Provider
>in this case) and calling AcquireCredentialsHandle(). The client then initates
>a series of calls to InitializeSecurityContext() passing and receiving buffers
>from the server. On the server side a similar call to
>AcquireCredentialsHandle() is followed by a series of calls to
>AcceptSecurityContext() recieiving and passing buffers to the client. The
>client never obtains a username or a password explicitly.

Unix doesn't have a generic security mechanism like this. Applications
that need to do user authentication provide their own mechanism to get the
username and password from the user, then look them up in /etc/passwd, and
call crypt() on the password to validate it.

It becomes more complicated on systems with shadow password files, since
only the superuser can read the passwords.

--

Genuity, Burlington, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.

by **David Schwart** » Fri, 21 Jul 2000 04:00:00

> On Win32, the client initiates authentication with the server by using a
> security support provider (Windows NT Lan Mananager Security Support Provider
> in this case) and calling AcquireCredentialsHandle(). The client then initates
> a series of calls to InitializeSecurityContext() passing and receiving buffers
> from the server. On the server side a similar call to
> AcquireCredentialsHandle() is followed by a series of calls to
> AcceptSecurityContext() recieiving and passing buffers to the client. The
> client never obtains a username or a password explicitly.

So that means that you have a network connection between two machines
(call them the client and the server), and the server is trying to
determine whether the client has access to some sort of account on the
server machine?

This breaks down into two cases:

1) The account is a real system account, an entry in /etc/passwd, and
can own files on the server machine.

2) The account is virtual in some way and has meaning to user code in
the server but no special meaning to the operating system.

If you are dealing with case 1, take a look at other programs that need
to do the exact same thing. Things like 'login' and 'ftpd'. Alternately,
rig it so that the server code itself is invoked with that user's
privileges, for example using 'ssh' as a launcher. Your process can then
just call 'getuid()' to find out what user's privileges it has.

If you are dealing with case 2 (which should be more common), you can
do it any way that you want. You can exchange credential information
however you find most appropriate.

DS

Very Computer

How do you validate user credentials?

How do you validate user credentials?

How do you validate user credentials?

How do you validate user credentials?

How do you validate user credentials?

How do you validate user credentials?