GSSAPI and Active Directory in C#

Question

This may be a silly question, but is it possible to obtain GSSAPI token for current logged in user from Active Directory?

I have a simple library that connects to server. I can pass user name, password and domain name or GSS Token (base64). For now first method works for me, but it is annoying to users that they must put their password.

I couldn't find any informations about GSSAPI and it's integration with Active Directory.

Is it possible in C#?

Some more informations based on @Harvey Kwok comment: Library is called Altair COM and it is used for document management

Here is some API reference about Login with GSS:

HRESULT LoginGSS(
     [in] VARIANT *token,
     [in] VARIANT_BOOL forceCreateNew,
     [out,retval] VARIANT *retToken)

And below is sample usage in VB:

Dim token(tokensize) As Byte 'token size-1
’fill token buffer
...
Dim outToken() As Byte
outToken = altair.LoginGSS(token,True)
'if GetLastStatus == AXAPI_ALTAIR_LOGIN_CONTINUE then
'outToken contains return GSS API token

And VC++ usage

SAFEARRAYBOUND sab[1];
sab[0].lLbound=0;
sab[0].cElements=tokensize;
SAFEARRAY *sa;
sa=SafeArrayCreate(VT_UI1,1,sab);
unsigned char HUGEP *buf=NULL;
SafeArrayAccessData(sa,(void HUGEP**)&buf);
//fill token buffer
...
SafeArrayUnaccessData(sa);
v.vt=VT_ARRAY|VT_UI1;
v.pparray=sa;
VARIANT vOut;
pAltair->LoginGSS(&v,true,&vOut);
SafeArrayDestroy(sa);
'if GetLastStatus == AXAPI_ALTAIR_LOGIN_CONTINUE then
'outToken contains return GSS API token

This are all informations that I have.

---

I found some code snippet showing login procedure:

byte[] token;
token = Convert.FromBase64String(tbToken.Text);
Object o;
o = (Object)token;
Program.altair.LoginGSS(ref o, true);
if ((AXAPILib.AxAPIStatus)altair.GetLastStatus()==AXAPILib.AxAPIStatus.AxAltairLoginOK)
{
    //login ok
}

But I must enter that token and I'm still trying to generate it for current user.

Answer 1

Don't waste your time. Use SSPI with P/Invoke in C#.

Answer 2

Microsoft has an example of using SSPI in Managed C++ (which is easy to then call from C#) here: http://msdn.microsoft.com/en-us/library/ms973911.aspx

Why not write it in C#? I experimented with writing the assembly in C# as well as Managed C++. I quickly discovered a basic trade-off: did I want to work with unmanaged code like the SSPI in a managed language (like C#) or did I want to write it in C++ and use managed extensions to interface to the .NET world?

With SSPI there are a number of functions with complex parameters. This includes lots of pointers, (nested) structures, and so on. Writing the assembly in C# means that having to declare managed versions of the SSPI function parameters (all of those complex types) and then making sure they're properly pinned in memory when passing them to the unmanaged functions.

Writing the assembly in managed C++ means dealing with the unmanaged types in their native environment. You don't necessarily have to worry about pinning and you don't have to re-declare types (just pull in the appropriate header files).

When building Microsoft.Samples.Security.SSPI, I found it was easier to do the job in Managed C++. All of the complex types are kept in the unmanaged world; the unmanaged APIs are dealt with in their native C environment. Managed C++ provides a great way to bridge the gap between the unmanaged/managed world.

Your mileage may vary and choice is going to depend on the APIs being used. But with SSPI, managed extensions make more sense than a higher level language like C#.