Export (0) Print
Expand All
3 out of 3 rated this helpful - Rate this topic

Context Requirements

Context requirements are expressed as a combination of bit flags passed to either the InitializeSecurityContext (General) or AcceptSecurityContext (General) function. These flags affect the context in a number of ways. Not all flags apply to all contexts. Some are valid only for the server, others only for the client.

The caller uses the fContextReq parameter of the InitializeSecurityContext (General) or AcceptSecurityContext (General) call to specify a set of flags that indicate the required capabilities. When the function returns, the pfContextAttr parameter indicates the attributes of the established context. The caller determines whether the final context attributes are acceptable.

Flags requested from or returned by InitializeSecurityContext (General) are prefixed by ISC. Those requested from or returned by AcceptSecurityContext (General) are prefixed by ASC. Flags passed into a function include REQ, while returned flags include RET. For example, a request flag for mutual authentication passed to InitializeSecurityContext (General) is ISC_REQ_MUTUAL_AUTH. A server requesting mutual authentication passes ASC_REQ_MUTUAL_AUTH to AcceptSecurityContext (General). If mutual authentication is achieved, InitializeSecurityContext (General) returns ISC_RET_MUTUAL_AUTH and AcceptSecurityContext (General) returns ASC_RET_MUTUAL_AUTH. If the caller requests mutual authentication, but the security package indicates that it cannot be performed, the caller must decide whether to cancel the context or continue.

The following table describes the various context requirement flags.

FlagDescription

DELEGATE

The server in the transport application can build new security contexts impersonating the client that will be accepted by other servers as the client's contexts. Delegate works only if MUTUAL_AUTH is set. DELEGATE is currently supported only by Kerberos. Further, Kerberos will delegate only to a server that has the flag TRUSTED_FOR_DELEGATION. Do not use this flag for constrained delegation.

MUTUAL_AUTH

The communicating parties must authenticate their identities to each other. Without MUTUAL_AUTH, the client authenticates its identity to the server. With MUTUAL_AUTH, the server also must authenticate its identity to the client.

When using the Schannel security package, the server sets the ASC_RET_MUTUAL_AUTH constant only in the last call to AcceptSecurityContext (Negotiate), after certificate mapping has successfully completed.

REPLAY_DETECT

The security package detects replayed packets and notifies the caller if a packet has been replayed. The use of this flag implies all of the conditions specified by the INTEGRITY flag.

SEQUENCE_DETECT

The context must be allowed to detect out-of-order delivery of packets later through the message support functions. Use of this flag implies all of the conditions specified by the INTEGRITY flag.

CONFIDENTIALITY

The context can protect data while in transit using the EncryptMessage (General) and DecryptMessage (General) functions. The CONFIDENTIALITY flag does not work if the generated context is for the Guest account.

USE_SESSION_KEY

A new session key must be negotiated.

PROMPT_FOR_CREDS

If the client is an interactive user, the security package must, if possible, prompt the user for the appropriate credentials.

USE_SUPPLIED_CREDS

Package-specific credential information is available in the input buffer. The security package can use these credentials to authenticate the connection.

SAVE_SUPPLIED_CREDS

The supplied credentials should be cached with the supplemental credentials.

ALLOCATE_MEMORY

The security package must allocate memory. The caller must eventually call the FreeContextBuffer function to free memory allocated by the security package.

USE_DCE_STYLE

The caller expects a three-leg authentication transaction.

DATAGRAM

Datagram semantics must be used. For more information, see Datagram Contexts.

CONNECTION

Connection semantics must be used. For more information, see Connection-Oriented Contexts.

STREAM

Stream semantics must be used. For more information, see Stream Contexts.

EXTENDED_ERROR

Error reply messages for the peer must be generated if the context fails.

INTEGRITY

Buffer integrity can be verified but no sequencing or reply detection is enabled.

NO_INTEGRITY

The INTEGRITY requirement is ignored.

IDENTIFY

When a server impersonates a context that has this flag set, that impersonation yields extremely limited access. Impersonation with IDENTIFY set is used to verify the client's identity.

 

 

 

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft. All rights reserved.