Authenticate with SSPI to vSphere using C# API

Question

I am using the C# library for connecting to vSphere (VimClient). I use this method to log in:

VimClient client = new VimClient();
client.Connect("https://vSphereMachine/sdk");
client.Login("userName", "password");

The user I'm logging in as is the current user used by the process. Is there a way I can use the current logged in user for authentication?

This thread seems to offer suggestions but nothing I tried there works: http://communities.vmware.com/message/1125103

That may be because I'm not familiar with the SSPI implementation in .NET.

Answer 1

As VMWare.Vim.dll just wraps the generated WCF Service client, I was ble to adapt this sample project to using the dll directly. This is my adaptation of his LoginBySspiPackage method.

    private UserSession LoginBySspiPackage(SspiPackageType sspiPackage, string serviceSpn)
    {
        Log($"Logging in to VSphere instance {VimClient.ServiceUrl} using SSPI.");
        var sspiClient = new SspiClient(serviceSpn, sspiPackage);
        var sessionManager = new SessionManager(VimClient, VimClient.ServiceContent.SessionManager);

        var serverNotReady = true;
        UserSession session = null;

        while (serverNotReady)
        {
            try
            {
                var base64String = Convert.ToBase64String(sspiClient.Token);
                session = sessionManager.LoginBySSPI(base64String, "en");

                serverNotReady = false; // Connected!  
            }
            catch (VMware.Vim.VimException e)
            {
                if (e.MethodFault is SSPIChallenge)
                {
                    var sspiChallenge = e.MethodFault as SSPIChallenge;
                    var base64String = Convert.FromBase64String(sspiChallenge.Base64Token);
                    sspiClient.Initialize(base64String);
                }
                else if (e.MethodFault is InvalidLogin)
                {
                    throw new InvalidLoginException(e.Message);
                }
                else
                {
                    throw;
                }
            }
        }

        return session;
    }