Homo et MachinaPreview
Open in TheBrain

Local Security Authority, LSA, API

Contents

Overview

LSA Authentication describes the parts of the Local Security Authority (LSA) that applications can use to authenticate and log users on to the local system. It also describes how to create and call authentication packages and security packages.

General Scoping Information

The first step in handling a Windows SDK support incident is to work with the customer to define the following sections in MSSolve if the information is not already available. Each section below contains basic questions you can ask the customer that will help with defining the issue.

If information is already provided, confirm with the customer that the information is accurate.

Problem Description

  1. Ask the customer to provide a complete description of the issue. Is the customer:
    1. Requesting assistance with troubleshooting an application crash?
    2. Requesting assistance with troubleshooting an application hang?
    3. Requesting assistance with troubleshooting an application performance issue?
    4. Requesting assistance with troubleshooting a unexpected behavior or a failure when calling a Windows API.
    5. Requesting assistance with how to use a Windows API or feature.
  2. If the customer is requesting assistance with troubleshooting an application crash, has the customer collected and uploaded a full memory dump of the faulting process? If no, work with the customer to collect a full memory dump of the process when the application crashes.
  3. If the customer is requesting assistance with troubleshooting an application hang, has the customer collected and uploaded any data when the application is hung? This can include periodic dumps of the process, call stacks, etc. If no, work with the customer to collect data regarding the hung process. {link to process for collecting data for a hung process}
  4. If the customer is requesting assistance with troubleshooting an application performance issue, what is the nature of the performance issue (CPU, disk, network, etc.). Work with the customer to collect data relevant to the type of performance issue the customer is encountering. {link to process for collecting performance data}
  5. If the customer is requesting assistance with troubleshooting a unexpected behavior or a failure when calling a Windows API, identify the Windows API. What is the error code that is being returned from the API/GetLastError? Describe the unexpected behavior?

Scope Agreement

  1. What is the customer's goal for this support incident?
  2. What would be considered a successful resolution to the issue?

Environment

  1. What version(s) of Windows? Are the systems fully patched?
  2. What .NET Framework version does the application use?
  3. What development tool was used to build the application?
  4. What programming languages were used to develop the application?
  5. Virtualization?
  6. If this is a new problem, what changed in the application code or environment that triggered the problem?

Data Collection Info

Once you have obtained a problem description, refer to the following sections for additional information.

Scenarios

Delegation is not working
  1. Is delegation properly configured?
  2. Are you accessing a file server? If yes, refer to KB2602377 .
Custom Authentication Package

The documentation implies that an ISV could write their own custom Authentication Package. Over the years, many ISVs have failed when trying to create their own packages because all the required interfaces are NOT documented. No ISV has been successful in implementing a package. It appears that we may have introduced the Negotiate Authentication Package to address some of these issues.

Sub Authentication Package

ISVs should avoid taking too much time in their SubAuth DLL because it blocks the authentication itself.

Unable to convert a SID to a name or vice versa, 1332 or ERROR_NONE_MAPPED, STATUS_NONE_MAPPED or STATUS_SOME_NOT_MAPPED, or System.Security.Principal.IdentityNotMappedException

Refer to How to resolve a System.Security.Principal.IdentityNotMappedException?

The trust relationship between the primary domain and the trusted domain failed

This is a very common error when converting a Security Identifier (SID) to a readable name. This can apply to users or groups.

Ticket Granting Tickets (TGT)
Kerberos Ticket Logon
LsaLogonUser
MSCHAP
SmartCard Logon

Concepts

No concepts have been identified at this point. Please contribute to this workflow if you get any issues in this area.

Glossary

A DLL that encapsulates the authentication logic used to determine whether to permit a user to log on. LSA authenticates a user logon by sending the request to an authentication package. The authentication package then examines the logon information and either authenticates or rejects the user logon attempt.

The Kerberos authentication package is used when logging on to a network

The S4U2Self Kerberos extension can be used to initialize a user's token with the user ID with a valid Windows account in Active Directory. The password associated with the user ID is not required. This feature allows you to transition from any authentication protocol into the Kerberos authentication protocol. This operation is accomplished by using the ticket-granting ticket (TGT) of a service account to request a service ticket for itself. The service account in this case is the one associated with the Web service that performs the protocol transition. The service ticket that is returned from the ticket-granting service (TGS) contains identity and principal information for the user whose ID was sent with the request.

(LUID) A 64-bit value that is guaranteed to be unique on the operating system that generated it until the system is restarted.

A logon session begins whenever a user logs on to a computer. All processes in a logon session have the same primary access token. The access token contains information about the security context of the logon session, including the user's SID, the logon identifier, and the logon SID.

The LSA_STRING structure is used by Local Security Authority (LSA) functions to specify an ANSI string. Note that strings returned by the LSA may not be null-terminated. When the Length structure member is zero and the MaximumLength structure member is 1, the Buffer structure member must not be an empty string or contain solely a null character.

Local Security Authority Subsystem Services (LSASS). This is a protected process.

MS-CHAP is the Microsoft version of the Challenge-Handshake Authentication Protocol, CHAP. The protocol exists in two versions, MS-CHAPv1 (defined in RFC 2433) and MS-CHAPv2 (defined in RFC 2759).

The MSV1_0 authentication package for local machine logons that do not require custom authentication.

See Kerberos Constrained Delegation Overview

A specification that defines security-related data objects and rules about how the objects are used to maintain security on a computer system.

The S4U2Proxy Kerberos extension provides an implementation of constrained delegation that allows you to use a Kerberos service ticket instead of a TGT to request another service ticket. Delegation is considered to be constrained because the identity (service account) that is used to request the service ticket must be configured to access a specific service.

Other Resources

LSA Authentication documentation Using LSA Policy Security Glossary

MCS/PSS WinNT Winlogon/Security Forum Product Security Discussion Forum

Attachments