The Local Authentication Subsystem (LASS) provides the infrastructure that enables user authentication independent of the application and the specific authentication mechanism. Password authentication provides only one option, a password, for verification. However, LASS allows you to support sophisticated authentication mechanisms, such as biometrics. In addition, you can use LASS functionality to specify event-based policies to authenticate users.

For more information about how LASS differs from the traditional password-based authentication schemes in previous versions of Windows Embedded CE, see Comparing LASS and Password Authentication.

An authentication mechanism that plugs into LASS is called a Local Authentication Plugin (LAP). For more information, see Local Authentication Plugin (LAP). Access to a plugin is governed by an Authentication Event (AE) that represents the point at which a predefined policy (or rule) is applied to determine if a user needs to be authenticated. See Authentication Event (AE) for more information.

Depending on your role in the device life-cycle, you will perform all or a certain subset of LAP-related tasks. For example, as an original equipment manufacturer, you might be interested in creating a custom LAP. For more information, see LASS OS Design Development.

If you are an application developer, you might want to create an application that installs an AE and performs user verification. For more information about writing applications for LASS, see LASS Application Development.

If you are a system administrator configuring a device, you might be interested in installing a LAP, setting an active LAP, or setting an AE policy. Instructions for system administration are included in Configuring LASS.