user password validating

BrianWren · April 22nd, 2005, 11:01 AM

It seems safe to presume that if they have gotten into Windows far enough to run your app, they have a valid login. . .

sujithvmenon · May 4th, 2005, 05:02 AM

Quote:

quote:Originally posted by pgtips
Doug, I don't know if you're still interested in this but, for the sake of the archive, I stumbled across this interesting piece of code which uses the LogonUser WinAPI function to validate a given user name and password (note, though, that it does not get the current password of the user)

Code:

Private Declare Function LogonUser Lib "Advapi32" Alias "LogonUserA" (ByVal _
    lpszUserName As String, ByVal lpszDomain As String, _
    ByVal lpszPassword As String, ByVal dwLogonType As Long, _
    ByVal dwLogonProvider As Long, phToken As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As _
    Long
Const LOGON32_PROVIDER_DEFAULT = 0&
Const LOGON32_LOGON_NETWORK = 3&

' Check whether a username/password pair is correct
'
' if DOMAIN is omitted, it uses the local account database
' and then asks trusted domains to search their account databases
' until it finds the account or the search is exhausted
' use DOMAIN="." to search only the local account database

Private Function CheckWindowsUser(ByVal UserName As String, _
    ByVal Password As String, Optional ByVal Domain As String) As Boolean

    Dim hToken As Long, ret As Long

    ' provide a default for the Domain name
    If Len(Domain) = 0 Then Domain = vbNullString
    ' check the username/password pair
    ' using LOGON32_LOGON_NETWORK delivers the best performance
    ret = LogonUser(UserName, Domain, Password, LOGON32_LOGON_NETWORK, _
        LOGON32_PROVIDER_DEFAULT, hToken)

    ' a non-zero value means success
    If ret Then
        CheckWindowsUser = True
        CloseHandle hToken
    End If

End Function

BTW I found it on http://www.vb2themax.com

rgds
Phil

sujithvmenon · May 4th, 2005, 05:10 AM

Quote:

quote:Originally posted by pgtips
Doug, I don't know if you're still interested in this but, for the sake of the archive, I stumbled across this interesting piece of code which uses the LogonUser WinAPI function to validate a given user name and password (note, though, that it does not get the current password of the user)

Code:

Private Declare Function LogonUser Lib "Advapi32" Alias "LogonUserA" (ByVal _
    lpszUserName As String, ByVal lpszDomain As String, _
    ByVal lpszPassword As String, ByVal dwLogonType As Long, _
    ByVal dwLogonProvider As Long, phToken As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As _
    Long
Const LOGON32_PROVIDER_DEFAULT = 0&
Const LOGON32_LOGON_NETWORK = 3&

' Check whether a username/password pair is correct
'
' if DOMAIN is omitted, it uses the local account database
' and then asks trusted domains to search their account databases
' until it finds the account or the search is exhausted
' use DOMAIN="." to search only the local account database

Private Function CheckWindowsUser(ByVal UserName As String, _
    ByVal Password As String, Optional ByVal Domain As String) As Boolean

    Dim hToken As Long, ret As Long

    ' provide a default for the Domain name
    If Len(Domain) = 0 Then Domain = vbNullString
    ' check the username/password pair
    ' using LOGON32_LOGON_NETWORK delivers the best performance
    ret = LogonUser(UserName, Domain, Password, LOGON32_LOGON_NETWORK, _
        LOGON32_PROVIDER_DEFAULT, hToken)

    ' a non-zero value means success
    If ret Then
        CheckWindowsUser = True
        CloseHandle hToken
    End If

End Function

BTW I found it on http://www.vb2themax.com

rgds
Phil

Hi Phil,
I tried the same code in my VB 6.0 std exe application to validate login agnst domain users.But unfortunately, "LogonUser" returns 0 (zero) even after providing correct username,password & domain name.Mine is a Win2000 domain server in the same n/w and my Vb appln will be installed in Win98/2000 Prof/XP.
Is there any way i can get the sample, working code for user validation be using
ActiveDirectory?
Plz give me a suggestion..
rgds & thanx in advance,
svmenon

pgtips · May 4th, 2005, 06:53 AM

Hi svmenon,

If you read the thread you'll see that this is just a bit of code I found on another site, I've never used it myself.

If you look at Microsoft's documentation for the LogonUser API function you'll see that it requires the SE_TCB_NAME privilege on Win2000, so maybe your process doesn't have the necessary rights?

What do you get from err.LastDllError just after the LogonUser call?
Could

sujithvmenon · May 4th, 2005, 07:02 AM

err.LastDllError value returned is 1314
rgds,
svm

pgtips · May 4th, 2005, 08:45 AM

Quote:

quote:Originally posted by sujithvmenon

err.LastDllError value returned is 1314
rgds,
svm

error 1314 is ERROR_PRIVILEGE_NOT_HELD, which (according to the Microsoft docs on LogonUser - did you read this?) is the exact error you will get if the process trying to call LogonUser does not have the SE_TCB_NAME privilege. So the problem is not with the code but with the user/process account that is trying to run the code.