How to implement a customized Security Support Provider to auth a user on a cloud?

Question

I want to provide an authentication mechanism on Windows for a user on a cloud.
The credential provider mostly satisfies this requirement with the premise that the user is a local user, Microsoft account or a domain user of this PC.
But I also would like to get escalated privilege as the user, even the user is only on a cloud, not a domain user or Microsoft account.

As far as I know, Microsoft provide a mechanism, SSP(Security Support Provider), kerberos and NTLM implements it.
There are few documents describing about SSP, such as The Windows Negotiation Extension and Writing NegoEx SSPs.
Futhermore, Spgetextendedinformationfn in my current implementation is called though.
But I cannot find any further information about what the data I should response to the LSA.

Is there any sample code about SSP, or I should try another way to achieve my goal?

Answer 1

Hello,

Welcome to Microsoft Q&A!

I suggest you could start form the following Docs:
SSP Packages Provided by Microsoft
LSA Authentication
Security Support Provider Interface (SSPI)

Thank you.

Jeanine

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello there,

SSP (Security Support Provider) is a mechanism in Windows that allows the operating system to support multiple authentication protocols. The Windows Negotiation Extension (WLN) is a Microsoft extension to the SSP framework that allows a client to negotiate the authentication protocol to be used with a server.

To implement an SSP, you will need to write code that handles the communication with the Local Security Authority (LSA) and implements the authentication protocol you want to support. The LSA will call your SSP's SpGetExtendedInformationFn function to request information about the authentication protocol and to initiate the authentication process.

I'm not aware of any sample code specifically for implementing an SSP, but you may find the documentation on the Windows Negotiation Extension and Writing NegoEx SSPs helpful in understanding the overall process.

Alternatively, you might consider using a different approach to achieve your goal of providing authentication for a cloud user with escalated privileges. One possibility could be to use a third-party authentication solution that integrates with Windows and supports the functionality you need.

--If the reply is helpful, please Upvote and Accept it as an answer–