Security

[MSSQLServerDeveloper]

I am running in a windows 2000 environment and have the following scenario /
question.

I have a vb.net application. Before allowing the user the go into the app,
I would like to validate against the windows password. Is there any easy way
to do this?
tia

[Crouchie1998]

Hi

No, there is no easy way to do this because the function LogonUser API
doesn't work in Windows 2000 unless you can set the SE_TCB_NAME (act as part
of the operating system), which will allow Windows 2000 to be opened up. That
means its an extremely big security risk.

If you find out how to set SE_TCB_NAME using VB.NET then there are literally
thousands of people who will want to know the answer because Microsoft would
NEVER release this information.

You can set SE_TCB_NAME manually in Windows 2000, but you are risking
security in a big way. Go into CONTROL PANEL, ADMINISTRATIVE TOOLS, LOCAL
SECURITY POLICY, expand USER RIGHTS ASSIGNMENT & 'add' users to ACT AS PART
OF THE OPERATING SYSTEM.

Restart the computer & now LogonUser 'should' work.

I DO NOT ADVISE YOU TO DO THIS - YOU HAVE BEEN WARNED!!!!!!!!!!!!!!!!!!!!!!!!

[MSSQLServerDeveloper]

What about a way to somehow validate against LDAP. I'm not saying I want to
know the password, just pass whatever the user types in to compare it . Any
other ideas?

"Crouchie1998" wrote:

Hi

No, there is no easy way to do this because the function LogonUser API
doesn't work in Windows 2000 unless you can set the SE_TCB_NAME (act as part
of the operating system), which will allow Windows 2000 to be opened up. That
means its an extremely big security risk.

If you find out how to set SE_TCB_NAME using VB.NET then there are literally
thousands of people who will want to know the answer because Microsoft would
NEVER release this information.

You can set SE_TCB_NAME manually in Windows 2000, but you are risking
security in a big way. Go into CONTROL PANEL, ADMINISTRATIVE TOOLS, LOCAL
SECURITY POLICY, expand USER RIGHTS ASSIGNMENT & 'add' users to ACT AS PART
OF THE OPERATING SYSTEM.

Restart the computer & now LogonUser 'should' work.

I DO NOT ADVISE YOU TO DO THIS - YOU HAVE BEEN WARNED!!!!!!!!!!!!!!!!!!!!!!!!

[Crouchie1998]

The LogonUser function doesn't give you the password because the password in
windows 2000 is converted to a one-way hash, so, when you log in its checked
against that hash.

The logon user function just fails on Windows 2000 without acting as part of
the operating system set.

However, if you are using Windows XP then the LogonUser function succeeds
because XP is so insecure & I am sure it used to pass the passwords as plain
text without using ZeroMemory to clear it from memory. Maybe with the
introduction with SP2 they have fixed that security flaw.

The best way for you in my opinion is to create a XML file & hold it in the
user's application data section of their profiles. You can encrypt/decrypt
the password & the users won't be able to get into anyone elses application
data folder. This method was suggested to me by Duncan MacKenzie from
Microsoft some time ago & I have implimented it in applications that needed
it.

[Jay B. Harlow [MVP - Outlook]]

MSSQLServerDeveloper,
In addition to the other comments.

Are you attempting to validate the current user or are you attempting to
authenticate the current user is allowed to use the program?

If you are attempting to validate the current user Keith Brown's book "The
..NET Developer's Guide to Windows Security" from Addison Wesley contains a
plethora of information on security under Win32 & specifically .NET.
Including a topic on how to prompt for a password. You can access the book
on-line at: http://www.pluralsight.com/keith/book/html/book.html I have not
tried the API reference, however a quick scan of MSDN suggests you might be
able to use it for the current user...

NOTE: Keith's book also includes a topic on how to run a program as another
user! (via the CreateProcessWithLogonW Win32 API)

If you are simply trying to authenticate the current user is allows to use
the program I would consider using Code Access Security and/or Role-Based
Security coupled with Win32 ACLs, rather then prompt for a password.

Info on Code Access Security:
http://msdn.microsoft.com/library/de...sssecurity.asp

Info on Role-Based Security:
http://msdn.microsoft.com/library/de...edsecurity.asp

Keith's book on info on using Win32 ACLs from .NET.

Hope this helps
Jay

"MSSQLServerDeveloper" <MS******************@discussions.microsoft.com>
wrote in message news:88**********************************@microsof t.com...

I am running in a windows 2000 environment and have the following scenario
/
question.

I have a vb.net application. Before allowing the user the go into the
app,
I would like to validate against the windows password. Is there any easy
way
to do this?
tia