{"id":132,"date":"2013-04-13T13:52:02","date_gmt":"2013-04-13T03:52:02","guid":{"rendered":"http:\/\/blog.wingsofhermes.org\/?p=132"},"modified":"2013-04-13T13:52:03","modified_gmt":"2013-04-13T03:52:03","slug":"implementating-a-ssaap-proxy","status":"publish","type":"post","link":"https:\/\/blog.wingsofhermes.org\/?p=132","title":{"rendered":"Implementating a SSA\/AP proxy"},"content":{"rendered":"<p>I&#8217;ve been messing around with the Windows LSA and implementing my own authentication package.&#160;It&#8217;s all part of an authentication server I&#8217;m building.&#160; The *NIX component (a PAM module) was pulled together in an afternoon.<\/p>\n<p>Windows is a slightly different story&#8230;..<\/p>\n<p>As always, MSDN has great documentation on the APIs, but there is not a lot of other reference material out there.&#160; I did find an <a href=\"http:\/\/kobyk.wordpress.com\/2008\/08\/30\/implementing-an-lsa-proxy-authentication-package\/\">article on building an LSA proxy<\/a> which was some help, but there was no real source code to work from.<\/p>\n<p>For anyone looking to implement an SSP\/AP, a couple of things to remember&#8230;<\/p>\n<ul>\n<li>Use a virtual machine with nothing on it bu Windows for testing.&#160; Make sure you have a Restore Point &#8211; you will break the boot process frequently!<\/li>\n<li>Remember to copy the Visual Studio shared runtime library over to \\windows\\System32 on your build system.&#160;(OK should have been obvious \ud83d\ude42 ).&#160; When LSASS.EXE can&#8217;t load a DLL it just ignores it quietly.&#160; No error, no nothing.<\/li>\n<li>Build the right architecture for your test system (yeah &#8211; again obvious&#8230;)<\/li>\n<\/ul>\n<p>There were some other things I found interesting.&#160; The API talks about a function table that both the Sp and the Ap functions should be registered in.&#160; Interestingly MSV1_0 (the NTLM authentication library) doesn&#8217;t include all the Ap functions in the table.&#160; So you need to find them in the DLL exports.&#160; Seems to be a hangover from old implementation I guess.<\/p>\n<p>Anyway &#8211; in the interests of helping others out there, the source codefor a basic proxy can be found <a href=\"http:\/\/www.wingsofhermes.org\/download\/LsaProxy-1.1.zip\">here<\/a>.<\/p>\n<p>It&#8217;s got the VS 2012 project in there.&#160; Just compile it, copy the DLL to \\Windows\\System32 on your test system and then add the library name to the list of library names in the following registry key:<\/p>\n<p><em>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\Security Packages<\/em><\/p>\n<p>Hope it&#8217;s of use to someone.&#160; The Pwitc name is the name of the authentication server I&#8217;m building &#8211; just pretend it says &quot;LsassProxy&quot; or somesuch!<\/p>\n<p>&#160;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve been messing around with the Windows LSA and implementing my own authentication package.&#160;It&#8217;s all part of an authentication server I&#8217;m building.&#160; The *NIX component (a PAM module) was pulled together in an afternoon. Windows is a slightly different story&#8230;.. As always, MSDN has great documentation on the APIs, but there is not a lot&hellip; <span class=\"clear\"><\/span><a href=\"https:\/\/blog.wingsofhermes.org\/?p=132\" class=\"more-link read-more\" rel=\"bookmark\">Continue Reading <span class=\"screen-reader-text\">Implementating a SSA\/AP proxy<\/span><i class=\"fa fa-arrow-right\"><\/i><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[4,15],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pX0hd-28","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=\/wp\/v2\/posts\/132"}],"collection":[{"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=132"}],"version-history":[{"count":1,"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=\/wp\/v2\/posts\/132\/revisions"}],"predecessor-version":[{"id":133,"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=\/wp\/v2\/posts\/132\/revisions\/133"}],"wp:attachment":[{"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=132"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=132"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.wingsofhermes.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=132"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}