如何再Win2000/XP下,加入自己的认证?

原创 2004年06月29日 15:27:00

利用Windows的GINA(Graphical Identification and Authentication )的机制,我们可以方便的在Windows的本机(Local)

实现自定义的认证过程。比如说SmartCard,UsbEkey认证......等.但在Windows的服务器端MS同样提供了一些机制来为我们实现

类似的功能。

以下为MSDN的文档:

Creating Custom Authentication Packages

If you are supporting a system that defines a new type of logon procedure, such as retinal scanning or voice recognition, you must create a custom authentication package to analyze the new logon data and determine whether to accept the user's credentials. You can also create new authentication packages that use standard logon data but implement new security protocols.

The LSA calls the Functions Implemented by Authentication Packages when it receives an authentication service request from a logon application. When a user attempts to log on to the system, the authentication package must check the user's logon data against the credentials information on file. The authentication packages provided with Windows store this information either in the security accounts manager (SAM) database or in the Active Directory (depending on the version and configuration of the operating system).

Windows NT, Windows 2000, or Windows XP does not permit applications that are not part of the operating system to access existing credentials data directly; to do so would create a security risk. To work around this restriction, your custom authentication package must call MSV1_0 to access the user's authentication information. Your package calls MSV1_0 to perform the initial authentication and create a logon session. If the initial authentication is successful, your package then performs additional processing to support the new logon protocol or algorithm and sends an authentication result to the LSA. In essence, your custom authentication package wraps MSV1_0, extending its functionality to support the new logon protocol. This following illustration shows this process.

Creating custom authentication packages

Both the custom authentication package and MSV1_0 support the authentication package interface (see Functions Implemented by Authentication Packages). The LSA calls the authentication package interface functions in the custom package which, in turn, call the functions in MSV1_0. The custom package must be able to pass the incoming logon information using data structures supported by MSV1_0. In addition, the structures passed to MSV1_0 should be allocated in the address space of the logon process, not the LSA address space.

The MSV1_0 package processes the authentication request and returns a result (and if successful, an LUID) to the custom package. The custom package can then perform additional authentication checks, such as deciding whether the scanned-in fingerprint matches the user account, and return an authentication success or failure back to the LSA. If your custom package revokes a logon allowed by MSV1_0, it must delete the logon session created by MSV1_0 by calling the DeleteLogonSession function.

最后如下注册:

Registering Subauthentication Packages

Each Subauthentication DLL is assigned a DLL number in the range 0 through 255. The DLL number is used to associate the subsystem calling LsaLogonUser with the appropriate Subauthentication DLL. DLL number 0 is reserved for the Domain Controller SubAuthentication Filter. This DLL allows the package to do additional password or logon validation on a domain controller in addition to that normally done by the MSV1_0 or Kerberos packages. DLL numbers 1 through 127 are reserved Microsoft DLL numbers. Numbers 128 through 254 are available to independent software vendors. Software vendors can be assigned a DLL number by Microsoft by sending e-mail to subauth@microsoft.com. Registering a subauthentication package with Microsoft prevents conflict between package IDs when multiple subauthentication packages are installed on a system.

Microsoft will not assign the value of 255 for any subauthentication DLL. If you are developing a subauthentication DLL for use only within your company or facility, subauthentication number 255 is recommended. In this case, it is not necessary to obtain a subauthentication DLL number from Microsoft.

After you have a DLL number, you can register the DLL under the related authentication package's registry key.

The registry location for MSV1_0 subauthentication packages is:

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/Lsa/MSV1_0

The registry location for Kerberos subauthentication packages is:

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/Lsa/Kerberos

If the required key does not exist, you must create it. Under that key, create a registry value named 'AuthN' where 'N' is the DLL number (for example, Auth255).

The 'AuthN' registry value holds REG_SZ data and must specify the name of the subauthentication package DLL. The DLL must be in the default DLL load path.

The authentication package loads the named DLL the first time the subauthentication package is requested

据我的经验,如果你还你没有得到MS的正式NUMBER,请用"0"即Auth0。

更多的信息参考PlatformSDK的文档

让你的win2000能运行98的程序如同xp兼容模式

有时我们在win2000安装一些小软件不能正常运行,可以试试让两千模拟win98的兼容环境来运行该程序。在sp4下的windows2000直截在运行注册regsvr32 c:/winnt/apppat...
  • wsp1
  • wsp1
  • 2005年03月17日 16:59
  • 2772

Win2000/WinXP/Win2003双系统启动

Win98SE/WinME和Win2000/WinXP/Win2003双系统启动        首先简要分析(深入讨论请参阅此帖)因重装Win98SE/WinME导致双启动故障的原因: 那是因为你格式...
  • debren
  • debren
  • 2005年03月05日 16:06
  • 3190

Windows XP/2000实现自动登陆(加入域和未加域两种情况)

Windows XP/2000实现自动登陆:不管计算机是否已加域,都可以通过更改注册表的方法来实现。 在注册表HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows...
  • davidullua
  • davidullua
  • 2004年09月11日 11:10
  • 3401

教你如何合并硬盘分区不用任何工具2000/xp/vista/win7

教你如何合并硬盘分区不用任何工具2000/xp/vista/win7
  • snlying
  • snlying
  • 2011年03月10日 09:31
  • 5004

Windows 98/2000/XP/2003访问XP的用户验证问题

Windows 98/2000/XP/2003访问XP的用户验证问题首先关于启用Guest为什么不能访问的问题:1、默认情况下,XP 禁用Guest帐户2、默认情况下,XP的本地安全策略禁止Guest...
  • yx10
  • yx10
  • 2004年10月08日 08:28
  • 3102

在XP安装盘中集成SATA驱动的方法

1.用EasyBoot做集成串行驱动的安装光盘 使用串行硬盘安装windows 2k/xp时都要插入串行驱动磁盘,你可以通过以下方法来自动加载它: 通过修改启动软盘组中的txtsetup.sif来实现...
  • ncdawen
  • ncdawen
  • 2006年01月06日 15:05
  • 8724

Windows 2000/XP上如何调用GB18030字符

安装gb18030工具包。下载:http://www.microsoft.com/downloads/details.aspx?FamilyID=93295d9c-89fc-4cba-ab19-ee1...
  • jollyjumper
  • jollyjumper
  • 2010年02月08日 23:57
  • 2708

系统大玩家Ghost 2000 Pro SP4/2K 装机版光盘 By:深度空间

图片: screen.width-461) window.open(http://bbs.povop.com/attachment/Mon_0712/2_4308_c24cee65c538421.jp...
  • bao1213
  • bao1213
  • 2007年12月03日 18:10
  • 4423

Windows 2000/XP下如何实现红外手机上网?

        手机上网是许多笔记本用户移动上网的通常方案,而通过红外上网则是最常用的方法了。近年来生产的手机基本上都具备了内置MODEM的功能,用户只需到当地电信营业厅开通数据业务(有的地方是开户时...
  • hzbairly
  • hzbairly
  • 2006年10月12日 11:36
  • 458

如何把SATA/RAID驱动集成到win xp 安装盘里?

   让SATA“嫁给”Windows XP   SATA硬盘有不少优点,但安装操作系统实在麻烦,不仅要抓住机会按“F6”键加载STAT的驱动程序,还要制作带驱动程序的软盘。要命的是如果新机器没有配置...
  • guoxl81
  • guoxl81
  • 2005年09月12日 19:56
  • 11468
内容举报
返回顶部
收藏助手
不良信息举报
您举报文章:如何再Win2000/XP下,加入自己的认证?
举报原因:
原因补充:

(最多只允许输入30个字)