Geek Answers Handbook

Using the SID of a Windows Account as a Security Token

I am creating some web services that I would like to protect using a special (i.e. NOT WS-Secure, etc.) method. My plan at present is to have a method that accepts an active username and password (via HTTPS, of course) to authenticate the user. This method will then obtain the account SID for this user and encrypt it using a secure but reversible method and pass it back as a security token.

After that, the caller will pass the encrypted token as a parameter for each web method as a means of authenticating the caller. Then the token can be decrypted and returned back to the directory entry (and, thus, confirm their accuracy) is pretty trivial. This provides an added bonus, allowing the methods to fully identify the authenticated subscriber.

However, using the SID from an account, which is usually internal only, bothers me a bit. It is safe?

EDIT: As I said in the comment below, I realized that the token must be “session-based”, that is, it must expire in order to reduce the chance of reusing the token. This is likely to be fixed if the client session is part of the token.

+5
source share
1 answer

That's right, here it goes - this is the long answer ...

The problem with this will be that saving the SID will not be sufficient to be able to re-authenticate the user if you need to perform an action on their behalf (that is, impersonate this user) - for this you will need the Software token provided by the operating system . If you only have a SID, you still need a password in this scenario - if you are not using reversible encryption in your AD repository, I seriously doubt it, and, of course, hope it is not!

, , , , SID , - ( , HTTPS ), .

- SID , .

, AD , Negotiate Kerberos. , ; , ( ).

, , - - , , .

, , , , . -, , ( - ). , :

, ( - ).

,

  • , , , , .
  • , , , , . - , . , , 403. , , , .

- , .

, HTTP , .

, - .. , . ; , .

∞

( )

, , - , .

HTTPS , , . , , , , . HTTPS .

, , , , IP- . , , HTTP.

, , - - , .

, , 12- - , , , 12- , , .

- , / , , , :)

+9

More articles:


All Articles