Validate Windows Identity Token

c#, identity, token, windows-authentication

Solution

Well,

If I understand correctly your question, I know it's possible to do it doing direct API Calls. The LogonUser in the advapi32.dll is the answer. The following snippet worked for me

public class ActiveDirectoryHelper
{
    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool LogonUser(
        string lpszUsername,
        string lpszDomain,
        string lpszPassword,
        int dwLogonType,
        int dwLogonProvider,
        out IntPtr phToken
        );

    [DllImport("kernel32.dll", SetLastError = true)]
    [return: MarshalAs(UnmanagedType.Bool)]
    public static extern bool CloseHandle(IntPtr hObject);

    public static bool Authenticate(string userName, string password, string domain)
    {
        IntPtr token;
        LogonUser(userName, domain, password, 2, 0, out token);

        bool isAuthenticated = token != IntPtr.Zero;

        CloseHandle(token);

        return isAuthenticated;
    }

    public static IntPtr GetAuthenticationHandle(string userName, string password, string domain)
    {
        IntPtr token;
        LogonUser(userName, domain, password, 2, 0, out token);
        return token;
    }


}

Problem

I am trying develop a simple web service to authenticate users of a desktop application using the windows identity framework, at present I am passing the token generated by `WindowsIdentity.GetCurrent().Token` via a post variable (it is encrypted and ssl'd, Windows authentication is not an option given the layout of our domain's and the configuration of the server). I am passing the token back fine and converting it back to an `IntPtr`. I am at a lost as to how to validate the token to ensure that it was generated by a particular Active Directory (or any for that matter). I have tried to create a new `WindowsIdentity` instance given the token however that just results in an Exception (message: Invalid token for impersonation - it cannot be duplicated). If anyone can provide any help or even hints I would greatly appreciated, thanks in advance.

Original source