Question

https://social.msdn.microsoft.com/Forums/vstudio/en-US/86f77b01-6da7-4321-8c57-563d9441de76/smartcard-custom-credential-provider?forum=windowssecurity

我想实现可通过SmartCard解锁Windows会话的Custom WindowsCredentialProvider。使用//用户名和密码可以正常使用，但SmartCard可能有问题。我使用此示例https://github.com/phaetto/windows-credentials-provider，并根据主题https://docs.microsoft.com/en-gb/windows/win32/api/wincred/nf-wincred-credpackauthenticationbuffera进行了更改，并按如下所示调用CredMarshalCredential：

    NativeMethods.CERT_CREDENTIAL_INFO certInfo = new NativeMethods.CERT_CREDENTIAL_INFO();
    certInfo.cbSize = (uint)Marshal.SizeOf(typeof(NativeMethods.CERT_CREDENTIAL_INFO));

    X509Certificate2 certCredential = new X509Certificate2();
    var userMyStore = new X509Store();
    userMyStore.Open(OpenFlags.ReadOnly);
    X509Certificate2Collection certsReturned = userMyStore.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);
    userMyStore.Close();

    if (certsReturned.Count == 0)
    {
            Console.WriteLine("Could not find the cert you want, aborting");
            return null;
    }

    certCredential = certsReturned[0];
    certInfo.rgbHashOfCert = certCredential.GetCertHash();
    int size = Marshal.SizeOf(certInfo);
    IntPtr pCertInfo = Marshal.AllocHGlobal(size);
    Marshal.StructureToPtr(certInfo, pCertInfo, false);
    IntPtr marshaledCredential = IntPtr.Zero;
    bool result = NativeMethods.CredMarshalCredential(NativeMethods.CRED_MARSHAL_TYPE.CertCredentia, pCertInfo, out marshaledCredential);

    var user = "";
    if (result)
    {
           user = Marshal.PtrToStringUni(marshaledCredential);
           var psCreds = new PSCredential(user, new SecureString());
    }

然后将用户名和SmartCard PIN传递给CredPackAuthenticationBuffer函数，并返回True，但无法解锁屏幕。我还记录了凭证方法调用，如下所示：

TestWindowsCredentialProvider::Advise
TestWindowsCredentialProvider::GetCredentialCount
TestWindowsCredentialProvider::GetCredentialAt
TestWindowsCredentialProvider::GetFieldDescriptorCount
TestWindowsCredentialProvider::GetFieldDescriptorAt
TestWindowsCredentialProvider::GetFieldDescriptorAt 
TestWindowsCredentialProviderTile::GetStringValue
TestWindowsCredentialProviderTile::GetFieldState
TestWindowsCredentialProviderTile::GetFieldState
TestWindowsCredentialProviderTile::GetSubmitButtonValue
TestWindowsCredentialProviderTile::Advise
TestWindowsCredentialProviderTile::SetSelected  
TestWindowsCredentialProviderTile::SetSelected
TestWindowsCredentialProviderTile::GetSerialization
TestWindowsCredentialProviderTile::SetDeselected
TestWindowsCredentialProviderTile::UnAdvise
TestWindowsCredentialProvider::UnAdvise

更新：当我使用域\用户名和密码日志时，除了在SetDeselected之后调用ReportResult之外，其他均相同

TestWindowsCredentialProviderTile::ReportResult

智能卡自定义凭据提供程序

0 个答案: