如何编写KSP连接到KERB_CERTIFICATE_LOGON

Question

嗨，我已经写了一个自定义的证书提供者，当使用用户名/密码作为凭证时，密码是通过蓝牙传输的。毕竟，这并不难，因为文档告诉您要实现哪些接口。

现在，我想将凭据更改为使用证书。我看到我应该为此使用KERB_CERTIFICATE_LOGON结构。深入研究这个主题，我发现我应该实现自定义密钥存储提供程序，如本文作者为微软中所描述的那样。这就是我迷失的地方。也许我太傻了，去搜索正确的文档，但我只是找不到我必须实现的接口，才能在KERB_CERTIFICATE_LOGON结构的CspData字段中引用KSP。我只是找到了一堆方法，快速搜索NCRYPT_CERTIFICATE_PROPERTY (在上面的链接文章中提到)，在google中发现了惊人的和结果。

我已经找到了这个问题，这将帮助我连接证书提供者和KSP当我有一个，但它没有解释如何编写KSP。:-(

有人能指导我在哪里找到信息或显示类似场景中使用的KSP的简短示例(仅是方法声明，以及如何在调用KERB_CERTIFICATE_LOGON时使用得到的KSP )吗？

Answer 1

这个Microsoft密码提供程序开发工具包有一个很好的KSP示例。

除了这个示例之外，您唯一需要做的事情是实现SmartCardKeyCertificate属性。代码将如下所示：

SECURITY_STATUS
WINAPI
KSPGetKeyProperty(
__in    NCRYPT_PROV_HANDLE hProvider,
__in    NCRYPT_KEY_HANDLE hKey,
__in    LPCWSTR pszProperty,
__out_bcount_part_opt(cbOutput, *pcbResult) PBYTE pbOutput,
__in    DWORD   cbOutput,
__out   DWORD * pcbResult,
__in    DWORD   dwFlags)
{

    ...

    if (wcscmp(pszProperty, NCRYPT_CERTIFICATE_PROPERTY) == 0)
    {
        dwProperty = SAMPLEKSP_CERTIFICATE_PROPERTY;
        cbResult = GetCertificateSize(); //the size of the certificate that is associated with the key
    }

    *pcbResult = cbResult;
    if(pbOutput == NULL)
    {
        Status = ERROR_SUCCESS;
        goto cleanup;
    }

    if(cbOutput < *pcbResult)
    {
         Status = NTE_BUFFER_TOO_SMALL;
         goto cleanup;
    }

    if (wcscmp(pszProperty, NCRYPT_CERTIFICATE_PROPERTY) == 0)
    {
        CopyMemory(pbOutput, crt, sizeof(crt));
    }


    switch(dwProperty)
    {
    case SAMPLEKSP_CERTIFICATE_PROPERTY:
        CopyMemory(pbOutput, GetCertificate(), cbResult); //Copy to pbOutput the certificate in binary form 
        break;

    ...

    }

    ...

}

在您实现KSP并注册它之后，您的CredentialProvider可以与它交互：

HRESULT MyCredential::GetSerialization(
    CREDENTIAL_PROVIDER_GET_SERIALIZATION_RESPONSE* pcpgsr,
    CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION* pcpcs,
    PWSTR* ppwszOptionalStatusText,
    CREDENTIAL_PROVIDER_STATUS_ICON* pcpsiOptionalStatusIcon
    )
{

    ...

    ULONG ulAuthPackage;
    HRESULT hr = RetrieveNegotiateAuthPackage(&ulAuthPackage);
    ConstructAuthInfo(&pcpcs->rgbSerialization, &pcpcs->cbSerialization);

    if (SUCCEEDED(hr))
    {
        pcpcs->ulAuthenticationPackage = ulAuthPackage;
        pcpcs->clsidCredentialProvider = CLSID_MyCredentialProvider;

        // At this point the credential has created the serialized credential used for logon
        // By setting this to CPGSR_RETURN_CREDENTIAL_FINISHED we are letting logonUI know
        // that we have all the information we need and it should attempt to submit the 
        // serialized credential.
        *pcpgsr = CPGSR_RETURN_CREDENTIAL_FINISHED;
    }

    return hr;
}

HRESULT RetrieveNegotiateAuthPackage(ULONG * pulAuthPackage)
{
    HRESULT hr = S_OK;
    HANDLE hLsa = NULL;

    NTSTATUS status = LsaConnectUntrusted(&hLsa);
    if (SUCCEEDED(HRESULT_FROM_NT(status)))
    {

        ULONG ulAuthPackage;
        LSA_STRING lsaszKerberosName;
        LsaInitString(&lsaszKerberosName, MICROSOFT_KERBEROS_NAME_A);
        status = LsaLookupAuthenticationPackage(hLsa, &lsaszKerberosName, &ulAuthPackage);
        if (SUCCEEDED(HRESULT_FROM_NT(status)))
        {
            *pulAuthPackage = ulAuthPackage;
            hr = S_OK;
        }
        else
        {
            hr = HRESULT_FROM_NT(status);
        }
        LsaDeregisterLogonProcess(hLsa);
    }
    else
    {
        hr = HRESULT_FROM_NT(status);
    }

    return hr;
}

void ConstructAuthInfo(LPBYTE* ppbAuthInfo, ULONG *pulAuthInfoLen)
{
    WCHAR szCardName[] = L""; // no card name specified but you can put one if you want
    WCHAR szContainerName[] = L"my_key_name";
    WCHAR szReaderName[] = L"";
    WCHAR szCspName[] = L"My Key Storage Provider";
    WCHAR szPin[] = L"11111111";
    ULONG ulPinByteLen = wcslen(szPin) * sizeof(WCHAR);
    WCHAR szUserName[] = L"user";
    ULONG ulUserByteLen = wcslen(szUserName) * sizeof(WCHAR);
    WCHAR szDomainName[] = L"testdomain.com";
    ULONG ulDomainByteLen = wcslen(szDomainName) * sizeof(WCHAR);
    LPBYTE pbAuthInfo = NULL;
    ULONG  ulAuthInfoLen = 0;
    KERB_CERTIFICATE_LOGON *pKerbCertLogon;
    KERB_SMARTCARD_CSP_INFO *pKerbCspInfo;
    LPBYTE pbDomainBuffer, pbUserBuffer, pbPinBuffer;
    LPBYTE pbCspData;
    LPBYTE pbCspDataContent;

    ULONG ulCspDataLen = sizeof(KERB_SMARTCARD_CSP_INFO)-sizeof(TCHAR)+
        (wcslen(szCardName) + 1) * sizeof(WCHAR)+
        (wcslen(szCspName) + 1) * sizeof(WCHAR)+
        (wcslen(szContainerName) + 1) * sizeof(WCHAR)+
        (wcslen(szReaderName) + 1) * sizeof(WCHAR);

    ulAuthInfoLen = sizeof(KERB_CERTIFICATE_LOGON)+
        ulDomainByteLen + sizeof(WCHAR)+
        ulUserByteLen + sizeof(WCHAR)+
        ulPinByteLen + sizeof(WCHAR)+
        ulCspDataLen;

    pbAuthInfo = (LPBYTE)CoTaskMemAlloc(ulAuthInfoLen);
    ZeroMemory(pbAuthInfo, ulAuthInfoLen);

    pbDomainBuffer = pbAuthInfo + sizeof(KERB_CERTIFICATE_LOGON);
    pbUserBuffer = pbDomainBuffer + ulDomainByteLen + sizeof(WCHAR);
    pbPinBuffer = pbUserBuffer + ulUserByteLen + sizeof(WCHAR);
    pbCspData = pbPinBuffer + ulPinByteLen + sizeof(WCHAR);

    memcpy(pbDomainBuffer, szDomainName, ulDomainByteLen);
    memcpy(pbUserBuffer, szUserName, ulUserByteLen);
    memcpy(pbPinBuffer, szPin, ulPinByteLen);

    pKerbCertLogon = (KERB_CERTIFICATE_LOGON*)pbAuthInfo;

    pKerbCertLogon->MessageType = KerbCertificateLogon;
    pKerbCertLogon->DomainName.Length = (USHORT)ulDomainByteLen;
    pKerbCertLogon->DomainName.MaximumLength = (USHORT)(ulDomainByteLen + sizeof(WCHAR));
    pKerbCertLogon->DomainName.Buffer = (PWSTR)(pbDomainBuffer-pbAuthInfo);
    pKerbCertLogon->UserName.Length = (USHORT)ulUserByteLen;
    pKerbCertLogon->UserName.MaximumLength = (USHORT)(ulUserByteLen + sizeof(WCHAR));
    pKerbCertLogon->UserName.Buffer = (PWSTR)(pbUserBuffer-pbAuthInfo);
    pKerbCertLogon->Pin.Length = (USHORT)ulPinByteLen;
    pKerbCertLogon->Pin.MaximumLength = (USHORT)(ulPinByteLen + sizeof(WCHAR));
    pKerbCertLogon->Pin.Buffer = (PWSTR)(pbPinBuffer-pbAuthInfo);

    pKerbCertLogon->CspDataLength = ulCspDataLen;
    pKerbCertLogon->CspData = (PUCHAR)(pbCspData-pbAuthInfo);

    pKerbCspInfo = (KERB_SMARTCARD_CSP_INFO*)pbCspData;
    pKerbCspInfo->dwCspInfoLen = ulCspDataLen;
    pKerbCspInfo->MessageType = 1;
    pKerbCspInfo->KeySpec = CERT_NCRYPT_KEY_SPEC;

    pKerbCspInfo->nCardNameOffset = 0;
    pKerbCspInfo->nReaderNameOffset = pKerbCspInfo->nCardNameOffset + wcslen(szCardName) + 1;
    pKerbCspInfo->nContainerNameOffset = pKerbCspInfo->nReaderNameOffset + wcslen(szReaderName) + 1;
    pKerbCspInfo->nCSPNameOffset = pKerbCspInfo->nContainerNameOffset + wcslen(szContainerName) + 1;

    pbCspDataContent = pbCspData + sizeof(KERB_SMARTCARD_CSP_INFO)-sizeof(TCHAR);
    memcpy(pbCspDataContent + (pKerbCspInfo->nCardNameOffset * sizeof(WCHAR)), szCardName, wcslen(szCardName) * sizeof(WCHAR));
    memcpy(pbCspDataContent + (pKerbCspInfo->nReaderNameOffset * sizeof(WCHAR)), szReaderName, wcslen(szReaderName) * sizeof(WCHAR));
    memcpy(pbCspDataContent + (pKerbCspInfo->nContainerNameOffset * sizeof(WCHAR)), szContainerName, wcslen(szContainerName) * sizeof(WCHAR));
    memcpy(pbCspDataContent + (pKerbCspInfo->nCSPNameOffset * sizeof(WCHAR)), szCspName, wcslen(szCspName) * sizeof(WCHAR));

    *ppbAuthInfo = pbAuthInfo;
    *pulAuthInfoLen = ulAuthInfoLen;
}

在这个代码中有两件主要的事情：

1. 为了与KSP交互，pKerbCspInfo->KeySpec 必须是 CERT_NCRYPT_KEY_SPEC。
2. 对于适当的结构序列化，根据这的回答： pKerbCertLogon->DomainName.Buffer = (PWSTR)(pbDomainBuffer-pbAuthInfo)；pKerbCertLogon->UserName.Buffer = (PWSTR)(pbUserBuffer-pbAuthInfo)；pKerbCertLogon->Pin.Buffer =(PWSTR)(PbPinBuffer)；pKerbCertLogon->CspData =(pbCspData-pbAuthInfo)；

此外，域控制器应该发出带有"Kerberos身份验证“模板的证书。