How to verify NT username and password?

[ALM]

I have a username and password sent to me from a remote NT machine. How do I check that they're valid for logging on to NT?

Thanks a bunch!
Alvaro

[Alex Fedotov]

You have two options:

1. Use LogonUser function (easy way). The calling process must have the
SE_TCB_NAME privilege.

2. Use NTLM SSP to validate credentials (hard way). The SE_TCB_NAME
privilege is not required.
http://support.microsoft.com/support.../Q180/5/48.ASP

[ALM]

This is exactly what I needed. Thank you very much!

Alvaro

[liuty]

How to let The calling process have the
SE_TCB_NAME privilege?

[Alex Fedotov]

The correct way is to make a service, which will run in the system logon
session and therefore will have SE_TCB_PRIVILEGE.

For testing purposes, you can grant this privilege to a specific user
account with User Manager in NT 4 or with Local Security Policy applet
in Window 2000. The privilege is named "Act as part of operating system"
in the GUI.

[liuty]

Now I longon Win2000 Srever as "adminstrator",and run the follow code.
I have set "User1" The privilege -- "Act as part of operating system" in the GUI as you told.
But can not run correctly.
The return value is ERROR_PRIVILEGE_NOT_HELD.



if (LogonUser("User1", ".", "User1",
LOGON32_LOGON_INTERACTIVE , LOGON32_PROVIDER_DEFAULT, &hToken) == FALSE){
dwRet = GetLastError();
if(dwRet == ERROR_LOGON_FAILURE)
cout << "ERROR_LOGON_FAILURE";
if(dwRet == ERROR_LOGON_TYPE_NOT_GRANTED)
cout << "ERROR_LOGON_TYPE_NOT_GRANTED";
if(dwRet == ERROR_PRIVILEGE_NOT_HELD)
cout << "ERROR_PRIVILEGE_NOT_HELD";
}

[Alex Fedotov]

The calling user must have the TCB privilege, not the user which you are
trying to log in. In your case, the administrator must have this privilege,
not User1.

[Padma kumar]

Hi,

The Proxy that i am using is strictly configured such that the internet clients (eg IE, Netscape or some customized internet clients) needs to authenticate by giving a
1. User Name
2. Pass Word
3. Domain Name

(If i am using IE and trying to open a url, immidiatly IE prompts a dialog for "User Name", "Pass Word" and "Domain Name" that are used for authentication from the serverside. These credentials are normally my emailid/password/email-domain-name)

I am trying to write a program that uses the following APIs for accessing the internet and download a page..
//START
HINTERNET goInetHnd;
HINTERNET aoURL;

//OPEN CONNECTION
goInetHnd = ::InternetOpen (
STD_BROWSER_SIG,
INTERNET_OPEN_TYPE_PRECONFIG,
NULL, NULL, 0
);

//SPECIFY AUTHENTICATION USERNAME
strcpy (azUser,"user-name");
aiUsrLen=strlen (azUser);
InternetSetOption (goInetHnd, INTERNET_OPTION_USERNAME, azUser, (unsigned long)aiUsrLen);

//SPECIFY AUTHENTICATION PASSWORD
strcpy (azPass, "pass-word");
aiPasLen=strlen (azPass);
InternetSetOption (goInetHnd, INTERNET_OPTION_PASSWORD, azPass, (unsigned long)aiPasLen);

//OPEN URL
aoURL = ::InternetOpenUrl (
goInetHnd,
azUrl,
NULL, 0, 0, 0
);

//GET PAGE DATA
InternetReadFile (aoURL, azTemp, aiReadLen, &aiLen); // placed in loop

//CLOSE URL
InternetCloseHandle (aoURL);
//END

Here i donno how to specify the "domain name" authentication. There is no option in InternetSetOption API like INTERNET_OPTION_DOMAINNAME. I also tried by passing the domain-name along with user-name as
//SPECIFY AUTHENTICATION USERNAME
strcpy (azDomAndUser,"domain-name\\user-name"); // strcpy (azDomAndUser,"\\domain-name\\user-name");
aiDomUsrLen=strlen (azDomAndUser);
InternetSetOption (goInetHnd, INTERNET_OPTION_USERNAME, azDomAndUser, (unsigned long)aiDomUsrLen);
And this is also not working..

I am in extreme need to obtain a good optimum solution for this.. if possible by using WinInet API. Please let me know your suggestion.

Regards
R.Padmakumar

[Alex Fedotov]

For proxy authentication you should use INTERNET_OPTION_PROXY_PASSWORD and INTERNET_OPTION_PROXY_USERNAME options. However, I have no idea where to put the domain name.