Weird problem with SSPI

[Kasparov]

I am facing a weird problem. Any pointers are much appreciated.

I am using SSPI for authentication on Windows 2003 machine. On my
server side I am checking whether my SSPI context user is part of the
backup operators (BO) group. Now the check always returns me false
even though the user is present in the BO group on that machine.

Strange thing is if I do logonuser using the same username and
password (with which the client is running) on the server side and try
to check whether the logon user token is part of the BO group it
returns me TRUE ! Have also tried with administrator group but there
the functionality is as expected (both the times it returns me true) .
So I am not sure whats going on. I am pasting part of my code below:

**************
// At this point SSPI handshake is complete.
AcceptSecurityContext has returned 0.

// Initialise SID for the Backup Operators group
if ( AllocateAndInitializeSid( &NtAuthority,
2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_BACKUP_OPS,
0, 0, 0, 0, 0, 0,
&BOGroup ) == 0)
{
ret_val = GetLastError();
break;
}


// Impersonate the context
ss = (*c->ImpersonateSecurityContext)(&c->hContext);
if (!SEC_SUCCESS(ss))
{
ret_val = E_CORBA_AUTH_FAILURE;
break;
}

// Fetch username with domain name from the SSPI context

HANDLE hToken = NULL;
PTOKEN_USER ptiUser = NULL;
DWORD cbti = 0;
SID_NAME_USE snu;



// Check group permissions

if (!CheckTokenMembership( NULL, BOGroup, &bIsMember)) //
Check whether part of the BO group
{
ret_val = GetLastError();
break;
}
if (bIsMember)
{
sspiContext.isBO = true;
}
else
{
}


// Do Logon user with the same credentials and impersonate to
fetch the access token
// here NDMPContext.username and password are of the same user
as obtained from SSPI context.

LogonAndImpersonateUser( (const CHAR *)
(ndmpContext.username).c_str(), (const CHAR *)
(ndmpContext.passsword).c_str() );


if (!CheckTokenMembership( NULL, BOGroup, &bIsMember))
{
BE_Zprintf(0, TEXT("checkGroupMembership:
CheckTokenMembership returned %d\n"), GetLastError() );
}
if ( ndmpContext.isAnonymous || ( !ndmpContext.isAdmin && !
ndmpContext.isBO ))
{
BE_Zprintf( 0, TEXT( "SSPIAuthenticate: Authenticating
user is ANONYMOUS or not part of the administrator / BO group.
Rejecting..." ));
ret_val = E_CORBA_AUTH_FAILURE;
break;
}


**************


Thanks in advance,
Ganesh Tambat

 

[Paul G. Tobey [eMVP]]

I think you've posted to the wrong group. This is not a .NET *Compact*
Framework question, right. Note that the group name here is
microsoft.public.dotnet.framework.***compactframework*. You'll have better
luck asking in a group that is related to your query. If this is a .NET CF
question, it should be obvious that you need to specifify what vesion of
Windows Mobile or Windows CE you're talking about, as well as what version
of the framework. I suspect that the desktop guys will immediately ask what
version of the framework, when you ask in the right place...

Paul T.