Why does the LogonUser API call succeed with the wrong password?
Rhys Jones
If the actual password is blank then LogonUser succeeds regardless of
the password supplied . . . Is this correct?
----------------------------------------------------------------------------------------------------------------
I'm trying to use LogonUser to validate username/password credentials
for a secure website that I'm building. Unfortunately, on the live web
server the call to LogonUser succeeds regardless of whether the
password is correct or not. As long as the user account is valid, it
ignores the password. On the test server it all works as expected.
Some details;
I'm using VB6 to create the COM+ components. The non-obvious
parameters to LogonUser are LOGON32_LOGON_NETWORK and
LOGON32_PROVIDER_DEFAULT.
The web server is IIS 5 on Windows 2000 Server.
The web server runs under the usual IUSR_<<MACHINE>> account. The COM+
application is configured to use a custom account which has been
granted 'Act as part of the OS' privileges.
Does anyone have any idea what's going on?
Rhys
Joe Richards
"unknown user name or bad password".
Take a look at my web site (www.joeware.net), I have a tool called auth.exe
that does command line authentication which uses the following for
authentication (C++):
if (LogonUser(lpszUserName, lpszDomain, lpszPassword,
LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &token))
{
cout <<"Logon Successful."<<endl;
retval=true;
}
You will see that if the password doesn't match up, it flags an error.
--
---
Joe Richards
humore...@hotmail.com
Opinions expressed are, as always, Joe's and probably insulting to someone
somewhere so just relax. =)
http://www.joeware.net
"Rhys Jones" <rh...@rmjcs.nospam.please.com> wrote in message
news:0viqntckolc2s1miq...@4ax.com...
Rhys Jones
I'm not talking about what I think ought to be happening, I'm talking
about what *is* happenings. I was a bit surprised myself so I have
double checked what is going on, and LogonUser is definitely returning
success (zero) if the username is valid and the actual users password
is blank, regardless of what password is supplied to LogonUser.
Any thoughts?
Like your site ;)
Rhys
Nimish Mathur
said... never a success..
"Rhys Jones" <rh...@rmjcs.com> wrote in message
news:tp12otc6jfqbelck6...@4ax.com...
Joe Richards
correct going on in the code. What that could be I am at a loss to say.
However the auth program should let you know if your system is acting flaky.
Thanks on the site. =)
--
---
Joe Richards
humore...@hotmail.com
Opinions expressed are, as always, Joe's and probably insulting to someone
somewhere so just relax. =)
http://www.joeware.net
"Rhys Jones" <rh...@rmjcs.com> wrote in message
news:tp12otc6jfqbelck6...@4ax.com...
Michael Stern
MSDN--LogonUser: If the function succeeds, the return value is nonzero.
MSDN--LogonUser: If the function fails, the return value is zero.
Use the app.lastdllerror to get the last dll-error.
"Rhys Jones" <rh...@rmjcs.com> schrieb im Newsbeitrag
news:tp12otc6jfqbelck6...@4ax.com...
Joe Richards
--
---
Joe Richards
humore...@hotmail.com
Opinions expressed are, as always, Joe's and probably insulting to someone
somewhere so just relax. =)
http://www.joeware.net
"Michael Stern" <mh...@gmx.at> wrote in message
news:Ol9VqdZKBHA.1716@tkmsftngp05...
Michael Stern
there's one big mistake one can make and that's thinking (s)he is perfect
and only all the other people's programs have bugs. ;)
cheers,
michael
"Joe Richards" <humore...@hotmail.com> schrieb im Newsbeitrag
news:ONZ$uHcKBHA.1128@tkmsftngp02...
Rhys Jones
meant non-zero. The snippet of VB code is as follows (with zero
clearly being failure!);
lngAPIResult = LogonUser(strUserName, gstrDomainName, _
strPassword, LOGON32_LOGON_NETWORK, _
LOGON32_PROVIDER_DEFAULT, _
lngTokenHandle)
If (lngAPIResult = 0) Then
' Report failure.
Else
lngAPIResult = CloseHandle(lngTokenHandle)
' Process success.
Thanks for your time and apologies for there being days between posts
but I'm not in the office as often as I ought to be.
Any more ideas?
Rhys
On Mon, 20 Aug 2001 18:38:36 +0200, "Michael Stern" <mh...@gmx.at>
wrote:
