Databases
StackOverflow2013
Postsdbo
POIs an LSA MSV1_0 subauthentication package needed for some impersonation use cases?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs an LSA MSV1_0 subauthentication package needed for some impersonation use cases?
    primarykey
    data
    text
    <p>Greetings,</p> <p>I'm working with a vendor who has implemented some code that uses a Windows LSA MSV1_0 subauthentication package (MSDN info if you're interested: <a href="http://msdn.microsoft.com/en-us/library/aa374786(VS.85).aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/aa374786(VS.85).aspx</a> ) and I'm trying to figure out if it's necessary.</p> <p>As far as I can tell, the subauthentication routine and filter allow for hooking or customizing the standard LSA MSV1_0 logon event processing. The issue is that I don't understand why the vendor's product would need these capabilities.</p> <p>I've asked them and they said they use it to perform impersonation. The product definitely does need to do impersonation, but based on my limited win32 knowledge, they could get the functionality they need using the normal auth APIs (LsaLogonUser, ImpersonateLoggedOnUser, etc) without the subauthentication package. Furthermore, I've worked with a number of similar products that all do impersonation, and this is the only one that's used a subauthentication package.</p> <p>If you're wondering why I would care, a previous version of the product had a bug in the subauthentication package dll that would cause lockups or bluescreens. That makes me rather nervous and has me questioning the use of such a low-level, kernel sensitive interface. I'd like to go back to the vendor and say "There's no way you could <em>need</em> an LSA subauth package for impersonation - take it out", but I'm not sure I understand the use cases and possible limitations of the standard win32 authentication/impersonation APIs well enough to make that claim definitively.</p> <p>So, to the win32 security gurus out there, is there any reason you would <em>need</em> an LSA MSV1_0 subauthentication package if all you were doing is impersonation?</p> <p>Thanks in advance for any thoughts!</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USChris Sears
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POIs an LSA MSV1_0 subauthentication package needed for some impersonation use cases?
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload