i can't believe it's been over two weeks since i've last had an opportunity to blog. first, i had to begin presenting our new seminar content focused entirely upon security in Cerritos (Los Angeles) and San Diego, then i co-presented two of the DevDays 2004 breakout sessions at the Los Angeles Convention Center last Monday, and finally, flew up to San Francisco and Sacramento to fill in security seminars for one of my colleague presenters.
of course, with all this travel and presentation content amid sporadic Internet connectivity, i've fallen way behind on everything including getting my local contributions in for the next edition of the MSDN Flash newsletter. once again, i'm at the mercy of Brad, the benevolent editor, who usually, generously tolerates my lateness.
just in case i've really outdone myself this time, here's my latest Developer to developer column though:
This week, a developer evangelist from Microsoft Sweden sent e-mail to all his counterparts around the world looking for information about writing a replacement module for the standard Windows logon procedure with one that supports a biometric device instead. Since I’ve been presenting security seminars up and down California for the past few weeks (and covering authentication in seminars before that), I thought I’d write about Winlogon and GINA here.
Winlogon is the component of the Windows operating system that provides interactive logon support. GINA is an acronym for Graphical Identification and Authentication and the standard GINA dynamic-link library that most of us use every day is the default one, MSGINA.DLL, for each Windows operating system. This is located in your System32 folder and can be replaced with a custom GINA DLL that provides alternative user identification and authentication procedures (such as hooking into the biometric device and supporting software per Johan from Sweden’s original information request).
Writing a custom GINA DLL is not necessarily a cakewalk. Reference documentation is provided describing the functions that a custom GINA DLL must implement, the Winlogon support functions that the GINA DLL can call upon and the data structures that are used to pass information between the GINA and Winlogon. It would probably serve you well to also familiarize yourself with the Windows security architecture and related concepts such as tokens, authentication packages and handling secure attention sequences (SAS), which by the way, is the technical term for this usage of Ctrl-Alt-Delete.
Sample code for implementing a GINA module in C code is provided in the Platform SDK Security samples but two cautions are in order. The Platform SDK code samples are all combined together into a rather large 135MB download. Also, it is possible (probable?) to render your computer unusable if you install a faulty replacement GINA DLL – be sure you can recover independent of the Windows operating system that you may find yourself locked out of…
Additionally, there is sample C code for a pass-through “stub” GINA layer that really just passes control of required functions to the previously installed, default GINA. What would be the point of such a stub then? Your code in such a custom stub GINA could take the user logon credentials and use them for additional authentication activities or synchronization with a foreign account database.
On a somewhat related note, if your application needs to perform additional processing during logon or logoff, or maintains state information in response to a Winlogon event that occurs, you will want to look into Winlogon notification packages. These are dynamic-link libraries that receive and handle events generated by Winlogon.
If you would like to find out more about security as it pertains to developers, please join me at one of my upcoming MSDN Events seminars.
i'll write more later but for now, i have to do my post-event reports. alas, the paperwork is never-ending...