某些模拟用例是否需要 LSA MSV1_0 子身份验证包？
您好，
我正在与一家供应商合作，该供应商已经实现了一些使用 Windows LSA MSV1_0 子身份验证包的代码（如果您感兴趣，请参阅 MSDN 信息：http://msdn.microsoft.com/en-us/library/aa374786(VS.85).aspx ) 和我'我想弄清楚是否有必要。
据我所知，子身份验证例程和过滤器允许挂钩或自定义标准 LSA MSV1_0 登录事件处理。 问题是我不明白为什么供应商的产品需要这些功能。
我问过他们，他们说他们用它来进行模仿。 该产品确实需要进行模拟，但基于我有限的 win32 知识，他们可以使用普通的身份验证 API（LsaLogonUser、ImpersonateLoggedOnUser 等）获得所需的功能，而无需子身份验证包。 此外，我使用过许多类似的产品，它们都进行模拟，这是唯一使用子身份验证包的产品。
如果您想知道我为什么会关心，该产品的先前版本在子身份验证包 dll 中存在一个错误，该错误会导致锁定或蓝屏。 这让我相当紧张，并让我质疑这样一个低级的、内核敏感的接口的使用。 我想回到供应商那里并说“您不可能需要 LSA 子身份验证包来进行模拟 - 将其取出”，但我不确定我是否理解用例并且标准 win32 身份验证/模拟 API 的可能限制足以明确地做出这一声明。
那么，对于 win32 安全专家来说，如果您所做的只是模拟，那么您是否需要 LSA MSV1_0 子身份验证包？
预先感谢您的任何想法！
Greetings,
I'm working with a vendor who has implemented some code that uses a Windows LSA MSV1_0 subauthentication package (MSDN info if you're interested: http://msdn.microsoft.com/en-us/library/aa374786(VS.85).aspx ) and I'm trying to figure out if it's necessary.
As far as I can tell, the subauthentication routine and filter allow for hooking or customizing the standard LSA MSV1_0 logon event processing. The issue is that I don't understand why the vendor's product would need these capabilities.
I've asked them and they said they use it to perform impersonation. The product definitely does need to do impersonation, but based on my limited win32 knowledge, they could get the functionality they need using the normal auth APIs (LsaLogonUser, ImpersonateLoggedOnUser, etc) without the subauthentication package. Furthermore, I've worked with a number of similar products that all do impersonation, and this is the only one that's used a subauthentication package.
If you're wondering why I would care, a previous version of the product had a bug in the subauthentication package dll that would cause lockups or bluescreens. That makes me rather nervous and has me questioning the use of such a low-level, kernel sensitive interface. I'd like to go back to the vendor and say "There's no way you could need an LSA subauth package for impersonation - take it out", but I'm not sure I understand the use cases and possible limitations of the standard win32 authentication/impersonation APIs well enough to make that claim definitively.
So, to the win32 security gurus out there, is there any reason you would need an LSA MSV1_0 subauthentication package if all you were doing is impersonation?
Thanks in advance for any thoughts!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我不相信软件包只是为了模仿。
在您提供的链接中，没有任何与“模拟”相关的内容，
我认为您可能有子身份验证包来在扩展级别验证用户，例如检查指纹，或询问用户更多详细信息，例如出生日期、安全问题等。
该包，我确实相信不是内核模式服务，所以不存在BSOD问题。
I do not believe packages are just for Impersonation.
In the link you gave, there is no nothing related to 'impersonation'
I think you may have subauthentication package to verify user, at extended level, like checking the finger print, or asking user more details like DOB, security question etc.
The package, I do believe is not kernel mode service, so there is no question of BSOD.