Re: GSSAPI/SSPI and mismatched user names

On Mon, Feb 24, 2014 at 1:06 PM, Stephen Frost <sfrost@snowman.net> wrote:
> I'm afraid you're going to need to try harder to find out how to get the
> Windows GSSAPI/SSPI code to give you the princ.  I was actually pretty
> sure that GSSAPI defined a way, but I don't know the Windows side of it
> or if they decided to not bother implementing parts of GSSAPI.

I don't think there's a Windows GSSAPI implementation at all. You're
expected to go through Win32 and all of their security providers.

Read here for some of the loveliness:

http://stackoverflow.com/questions/7613468/getting-the-current-username-when-impersonated

https://groups.google.com/forum/#!topic/microsoft.public.platformsdk.security/5L7ugO0Fc90

(Really, though, the Windows login infrastructure and API is rather nice.)


> Exactly- this is not something we can solve with a little bit of
> tweaking...

Nuts. It sounded easy   :P

--Brian