c++ - 如何编写 KSP 以连接到 KERB_CERTIFICATE_LOGON

Question

大家好，我写了一个自定义的 credentialprovider，当使用用户名/密码作为凭证时，它工作正常，密码通过蓝牙传输。毕竟这并不困难，因为文档会告诉您要实现哪些接口(interface)。

现在我想更改凭据以改为使用证书。我看到我应该为此使用 KERB_CERTIFICATE_LOGON 结构。深入研究该主题后，我发现我应该按照 this article by microsoft 中的描述实现自定义 key 存储提供程序。 .这就是我迷路的地方。也许我搜索正确的文档太愚蠢了，但我只是找不到我必须实现哪些接口(interface)才能拥有我可以在 KERB_CERTIFICATE_LOGON 结构的 CspData 字段中引用的 KSP。我只是找到了一堆方法并快速搜索 NCRYPT_CERTIFICATE_PROPERTY(在上面的链接文章中提到)在谷歌中显示了惊人的两个结果。

我找到了 this SO-question这将帮助我连接 credentialprovider 和 KSP，但它没有解释如何编写 KSP。 :-(

谁能指导我在哪里可以找到信息或展示在类似场景中使用的 KSP 的简短示例(只是方法声明，以及如何在调用 KERB_CERTIFICATE_LOGON 时使用生成的 KSP)？

Answer 1

这Microsoft Cryptographic Provider Development Kit有一个很好的 KSP 样本。

除了此示例之外，您唯一需要做的就是实现 SmartCardKeyCertificate属性(property)。代码将是这样的:

SECURITY_STATUS
WINAPI
KSPGetKeyProperty(
__in    NCRYPT_PROV_HANDLE hProvider,
__in    NCRYPT_KEY_HANDLE hKey,
__in    LPCWSTR pszProperty,
__out_bcount_part_opt(cbOutput, *pcbResult) PBYTE pbOutput,
__in    DWORD   cbOutput,
__out   DWORD * pcbResult,
__in    DWORD   dwFlags)
{

    ...

    if (wcscmp(pszProperty, NCRYPT_CERTIFICATE_PROPERTY) == 0)
    {
        dwProperty = SAMPLEKSP_CERTIFICATE_PROPERTY;
        cbResult = GetCertificateSize(); //the size of the certificate that is associated with the key
    }

    *pcbResult = cbResult;
    if(pbOutput == NULL)
    {
        Status = ERROR_SUCCESS;
        goto cleanup;
    }

    if(cbOutput < *pcbResult)
    {
         Status = NTE_BUFFER_TOO_SMALL;
         goto cleanup;
    }

    if (wcscmp(pszProperty, NCRYPT_CERTIFICATE_PROPERTY) == 0)
    {
        CopyMemory(pbOutput, crt, sizeof(crt));
    }


    switch(dwProperty)
    {
    case SAMPLEKSP_CERTIFICATE_PROPERTY:
        CopyMemory(pbOutput, GetCertificate(), cbResult); //Copy to pbOutput the certificate in binary form 
        break;

    ...

    }

    ...

}

在您实现并注册 KSP 后，您的 CredentialProvider 可以与其交互:

HRESULT MyCredential::GetSerialization(
    CREDENTIAL_PROVIDER_GET_SERIALIZATION_RESPONSE* pcpgsr,
    CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION* pcpcs,
    PWSTR* ppwszOptionalStatusText,
    CREDENTIAL_PROVIDER_STATUS_ICON* pcpsiOptionalStatusIcon
    )
{

    ...

    ULONG ulAuthPackage;
    HRESULT hr = RetrieveNegotiateAuthPackage(&ulAuthPackage);
    ConstructAuthInfo(&pcpcs->rgbSerialization, &pcpcs->cbSerialization);

    if (SUCCEEDED(hr))
    {
        pcpcs->ulAuthenticationPackage = ulAuthPackage;
        pcpcs->clsidCredentialProvider = CLSID_MyCredentialProvider;

        // At this point the credential has created the serialized credential used for logon
        // By setting this to CPGSR_RETURN_CREDENTIAL_FINISHED we are letting logonUI know
        // that we have all the information we need and it should attempt to submit the 
        // serialized credential.
        *pcpgsr = CPGSR_RETURN_CREDENTIAL_FINISHED;
    }

    return hr;
}

HRESULT RetrieveNegotiateAuthPackage(ULONG * pulAuthPackage)
{
    HRESULT hr = S_OK;
    HANDLE hLsa = NULL;

    NTSTATUS status = LsaConnectUntrusted(&hLsa);
    if (SUCCEEDED(HRESULT_FROM_NT(status)))
    {

        ULONG ulAuthPackage;
        LSA_STRING lsaszKerberosName;
        LsaInitString(&lsaszKerberosName, MICROSOFT_KERBEROS_NAME_A);
        status = LsaLookupAuthenticationPackage(hLsa, &lsaszKerberosName, &ulAuthPackage);
        if (SUCCEEDED(HRESULT_FROM_NT(status)))
        {
            *pulAuthPackage = ulAuthPackage;
            hr = S_OK;
        }
        else
        {
            hr = HRESULT_FROM_NT(status);
        }
        LsaDeregisterLogonProcess(hLsa);
    }
    else
    {
        hr = HRESULT_FROM_NT(status);
    }

    return hr;
}

void ConstructAuthInfo(LPBYTE* ppbAuthInfo, ULONG *pulAuthInfoLen)
{
    WCHAR szCardName[] = L""; // no card name specified but you can put one if you want
    WCHAR szContainerName[] = L"my_key_name";
    WCHAR szReaderName[] = L"";
    WCHAR szCspName[] = L"My Key Storage Provider";
    WCHAR szPin[] = L"11111111";
    ULONG ulPinByteLen = wcslen(szPin) * sizeof(WCHAR);
    WCHAR szUserName[] = L"user";
    ULONG ulUserByteLen = wcslen(szUserName) * sizeof(WCHAR);
    WCHAR szDomainName[] = L"testdomain.com";
    ULONG ulDomainByteLen = wcslen(szDomainName) * sizeof(WCHAR);
    LPBYTE pbAuthInfo = NULL;
    ULONG  ulAuthInfoLen = 0;
    KERB_CERTIFICATE_LOGON *pKerbCertLogon;
    KERB_SMARTCARD_CSP_INFO *pKerbCspInfo;
    LPBYTE pbDomainBuffer, pbUserBuffer, pbPinBuffer;
    LPBYTE pbCspData;
    LPBYTE pbCspDataContent;

    ULONG ulCspDataLen = sizeof(KERB_SMARTCARD_CSP_INFO)-sizeof(TCHAR)+
        (wcslen(szCardName) + 1) * sizeof(WCHAR)+
        (wcslen(szCspName) + 1) * sizeof(WCHAR)+
        (wcslen(szContainerName) + 1) * sizeof(WCHAR)+
        (wcslen(szReaderName) + 1) * sizeof(WCHAR);

    ulAuthInfoLen = sizeof(KERB_CERTIFICATE_LOGON)+
        ulDomainByteLen + sizeof(WCHAR)+
        ulUserByteLen + sizeof(WCHAR)+
        ulPinByteLen + sizeof(WCHAR)+
        ulCspDataLen;

    pbAuthInfo = (LPBYTE)CoTaskMemAlloc(ulAuthInfoLen);
    ZeroMemory(pbAuthInfo, ulAuthInfoLen);

    pbDomainBuffer = pbAuthInfo + sizeof(KERB_CERTIFICATE_LOGON);
    pbUserBuffer = pbDomainBuffer + ulDomainByteLen + sizeof(WCHAR);
    pbPinBuffer = pbUserBuffer + ulUserByteLen + sizeof(WCHAR);
    pbCspData = pbPinBuffer + ulPinByteLen + sizeof(WCHAR);

    memcpy(pbDomainBuffer, szDomainName, ulDomainByteLen);
    memcpy(pbUserBuffer, szUserName, ulUserByteLen);
    memcpy(pbPinBuffer, szPin, ulPinByteLen);

    pKerbCertLogon = (KERB_CERTIFICATE_LOGON*)pbAuthInfo;

    pKerbCertLogon->MessageType = KerbCertificateLogon;
    pKerbCertLogon->DomainName.Length = (USHORT)ulDomainByteLen;
    pKerbCertLogon->DomainName.MaximumLength = (USHORT)(ulDomainByteLen + sizeof(WCHAR));
    pKerbCertLogon->DomainName.Buffer = (PWSTR)(pbDomainBuffer-pbAuthInfo);
    pKerbCertLogon->UserName.Length = (USHORT)ulUserByteLen;
    pKerbCertLogon->UserName.MaximumLength = (USHORT)(ulUserByteLen + sizeof(WCHAR));
    pKerbCertLogon->UserName.Buffer = (PWSTR)(pbUserBuffer-pbAuthInfo);
    pKerbCertLogon->Pin.Length = (USHORT)ulPinByteLen;
    pKerbCertLogon->Pin.MaximumLength = (USHORT)(ulPinByteLen + sizeof(WCHAR));
    pKerbCertLogon->Pin.Buffer = (PWSTR)(pbPinBuffer-pbAuthInfo);

    pKerbCertLogon->CspDataLength = ulCspDataLen;
    pKerbCertLogon->CspData = (PUCHAR)(pbCspData-pbAuthInfo);

    pKerbCspInfo = (KERB_SMARTCARD_CSP_INFO*)pbCspData;
    pKerbCspInfo->dwCspInfoLen = ulCspDataLen;
    pKerbCspInfo->MessageType = 1;
    pKerbCspInfo->KeySpec = CERT_NCRYPT_KEY_SPEC;

    pKerbCspInfo->nCardNameOffset = 0;
    pKerbCspInfo->nReaderNameOffset = pKerbCspInfo->nCardNameOffset + wcslen(szCardName) + 1;
    pKerbCspInfo->nContainerNameOffset = pKerbCspInfo->nReaderNameOffset + wcslen(szReaderName) + 1;
    pKerbCspInfo->nCSPNameOffset = pKerbCspInfo->nContainerNameOffset + wcslen(szContainerName) + 1;

    pbCspDataContent = pbCspData + sizeof(KERB_SMARTCARD_CSP_INFO)-sizeof(TCHAR);
    memcpy(pbCspDataContent + (pKerbCspInfo->nCardNameOffset * sizeof(WCHAR)), szCardName, wcslen(szCardName) * sizeof(WCHAR));
    memcpy(pbCspDataContent + (pKerbCspInfo->nReaderNameOffset * sizeof(WCHAR)), szReaderName, wcslen(szReaderName) * sizeof(WCHAR));
    memcpy(pbCspDataContent + (pKerbCspInfo->nContainerNameOffset * sizeof(WCHAR)), szContainerName, wcslen(szContainerName) * sizeof(WCHAR));
    memcpy(pbCspDataContent + (pKerbCspInfo->nCSPNameOffset * sizeof(WCHAR)), szCspName, wcslen(szCspName) * sizeof(WCHAR));

    *ppbAuthInfo = pbAuthInfo;
    *pulAuthInfoLen = ulAuthInfoLen;
}

这段代码主要有两点:

1. 为了与 KSP 交互，pKerbCspInfo->KeySpec 必须CERT_NCRYPT_KEY_SPEC。

2. 为了正确的结构序列化，根据 this回答:

   pKerbCertLogon->DomainName.Buffer = (PWSTR)(pbDomainBuffer-pbAuthInfo); pKerbCertLogon->UserName.Buffer = (PWSTR)(pbUserBuffer-pbAuthInfo); pKerbCertLogon->Pin.Buffer = (PWSTR)(pbPinBuffer-pbAuthInfo); pKerbCertLogon->CspData = (PUCHAR)(pbCspData-pbAuthInfo);

域 Controller 还应使用“Kerberos 身份验证”模板颁发证书。