LDAP/SSPI相互认证问题 [英] LDAP/SSPI mutual authentication problem

问题描述

大家好！

我想问你一个有关使用SSPI和LDAP API与Kerberos进行相互身份验证的问题.

I would like to ask you a question about implementing mutual authentication with Kerberos, using SSPI and LDAP API.

这是我正在使用的算法:

Here is the algorithm I am using: 

//--------------------------------------------------------------------------------------------
// client side

AcquireCredentialsHandle(NULL, "Kerberos", SECPKG_CRED_BOTH, NULL, &secIdent, NULL, NULL, &kClientCredential, &kClientTimeOut); 
// AcquireCredentialsHandle returns SEC_E_OK

// begin validation

unsigned long ulClientFlags = ISC_REQ_CONNECTION | ISC_REQ_MUTUAL_AUTH | ISC_REQ_DELEGATE;

int iCliStatus = InitializeSecurityContext(&kClientCredential, isContextNull(kClientContext) ? NULL : &kClientContext, 
                             pacTargetName, ulClientFlags, 0, SECURITY_NATIVE_DREP, pkServerToken, 
                             0, &kClientContext, &kClientToken, &ulContextAttr, NULL);

// InitializeSecurityContext returns SEC_I_CONTINUE_NEEDED

//--------------------------------------------------------------------------------------------
// server side

// ldap_init returns ok

ldap_set_option(ld, LDAP_OPT_SIGN, LDAP_OPT_OFF);
ldap_set_option(ld, LDAP_OPT_ENCRYPT, LDAP_OPT_OFF);

unsigned long ulVersion = LDAP_VERSION3;
ldap_set_option(ld, LDAP_OPT_VERSION, &ulVersion);

// ldap_connect returns LDAP_SUCCESS

// build the credentials based on what InitializeSecurityContext returned
BERVAL creds;
creds.bv_len = kClientToken.pBuffers[0].cbBuffer;
creds.bv_val = reinterpret_cast<char*>(kClientToken.pBuffers[0].pvBuffer);

BERVAL* pServerCreds = NULL;
int iError = ldap_sasl_bind_s(ld, "", "GSSAPI", &creds, NULL, NULL, &pServerCreds);

// ldap_sasl_bind_s returns LDAP_SUCCESS

unsigned long ulError = 0;
ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ulError);

// ulError is equal to LDAP_SASL_BIND_IN_PROGRESS

推荐答案

胡安，

我将此线程移至Microsoft Windows论坛中的应用程序安全性"以获得更好的支持.

I'm moving this thread to Security for Applications in Microsoft Windows Forum for better support.

谢谢您的理解.

李凤丽

这篇关于LDAP/SSPI相互认证问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！