Thursday, March 5, 2009

How to do windows logon with smartcard

If you try to implement GINA replacement that fully supports all features that native msgina.dll supports , you have to implement smart card login (PKI). And here comes the problem. The information on how to do that is very limited. There is no even correct structures defnition available. It was not documented . Now it is defined in SDK , but not for systems earlier then Vista.(eg :Windows XP ).
I am speaking of


struct MY_KERB_SMART_CARD_LOGON
{
KERB_LOGON_SUBMIT_TYPE MessageType;
UNICODE_STRING Pin;
ULONG CspDataLength;
MY_KERB_SMARTCARD_CSP_INFO* CspData;
WCHAR pinData[256];
};
typedef MY_KERB_SMART_CARD_LOGON* PMY_KERB_SMART_CARD_LOGON ;


Compare it with msdn definition :


Somewhat different , eh?


typedef struct _KERB_SMARTCARD_CSP_INFO {
DWORD dwCspInfoLen;
DWORD MessageType;
ULONG nCardNameOffset;
ULONG nReaderNameOffset;
ULONG nContainerNameOffset;
ULONG nCSPNameOffset;
TCHAR bBuffer[1024];
} MY_KERB_SMARTCARD_CSP_INFO,
*PKERB_SMARTCARD_CSP_INFO;


Once again Compare it with MSDN definition .


And now the struct that should be supplied to LsaLogonUser as AuthenticationInformation parameter.

struct FullPacket
{
MY_KERB_SMART_CARD_LOGON smartCardLogon;
MY_KERB_SMARTCARD_CSP_INFO cspInfo;
};


Note : this is the most mystic thing that spoiled hours and days of debugging:

The LogonDomainName, UserName, and Password members of the MSV1_0_INTERACTIVE_LOGON structure must point to buffers in memory that are contiguous to the structure itself. The value of the AuthenticationInformationLength parameter must take into account the length of these buffers.

Yessss! And all others  , like  CardName, ReaderName,ContainerName,CSPName.

And one more thing ,  despite what  the msdn sais  about  KERB_SMARTCARD_CSP_INFO.MessageType


The type of message being passed. This member must be set to 1.

- for XP  it shold be 0.  I believe it is a version of the structure. 

That  is all  for now.  The clever one  can do the rest  ;)

Note : tested on 32bit  Windows XP & 2k3;