How to Implement an Additional Biometric Layer After Basic Authentication in Windows Using a Custom Credential Provider?

Auishik Pyne 5

By default Windows has a basic (e.g. password or pin ...) authentication-flow for PC machines. Our goal is to extend current level of authentication with additional biometric factors (e.g. fingerprint, 3D-face ...) to be implemented by 3rd-party vendors (e.g. sensor-device, sdk, driver, api ...). We want to integrate the service-provider's external api inside (possibly after the basic-auth layer) the current authentication-flow of Windows-PC. Thus far, an attempt has been made to develop a credential provider using ICredentialProvider interface. How to enable this additional layer (after basic authentication)?

Xiaopo Yang - MSFT 12,726 Reputation points Microsoft Vendor

2024-08-12T08:07:38.9366667+00:00

Did you check the document Credential Providers in Windows and these samples?
Xiaopo Yang - MSFT 12,726 Reputation points Microsoft Vendor

2024-08-15T08:00:07.7+00:00

@Auishik Pyne, any update about this question?
Roy Li - MSFT 33,001 Reputation points Microsoft Vendor

2024-08-20T09:42:50.03+00:00

Hope you've been well. Have you solved your issue?
Auishik Pyne 5 Reputation points

2024-08-21T05:49:47.92+00:00

I have developed a custom credential provider following sample codes and verified that the UI and method invocations work correctly. However, despite matching the hardcoded username and password, I cannot log in or access the Windows home page.

What could be causing the login failure with a custom credential provider, even when credentials are correct, and how can I resolve this issue?
Auishik Pyne 5 Reputation points

2024-08-21T05:52:40.89+00:00

I have developed a custom credential provider and verified that the UI and method invocations work correctly. However, despite matching the hardcoded username and password, I cannot log in or access the Windows home page.

What could be causing the login failure with a custom credential provider, even when credentials are correct, and how can I resolve this issue?
Auishik Pyne 5 Reputation points

2024-08-21T06:00:54.75+00:00

I've developed a custom credential provider and ensured the method calls and user interface function properly. But even though my username and password match the hardcoded credentials, I cannot log in to the Windows home page. Even when credentials are right, why might a custom credential provider not allow me to log in? How can I fix this problem?
Auishik Pyne 5 Reputation points

2024-08-21T06:05:52.17+00:00

I have developed a custom credential provider following sample codes. Currently, it is working as DLL instructed. I am trying to log in to windows home page using username and password. And I am matching them with hardcoded values. Even though I have used the correct username and password I can't log in. How can I fix that?
Xiaopo Yang - MSFT 12,726 Reputation points Microsoft Vendor

2024-08-21T07:35:09.7566667+00:00

Could you please show a minimal, reproducible code snippet without private information?
Auishik Pyne 5 Reputation points

2024-08-21T08:43:04.75+00:00

This is my GetSerialization method. This method is being invoked and I have got "Login successful. Credential packed and ready." log message. But still, It is not redirecting to Windows homepage. Can you help me to get it redirected to Windows home page?
Xiaopo Yang - MSFT 12,726 Reputation points Microsoft Vendor

2024-08-22T01:09:03.7633333+00:00

@Auishik Pyne, could you please show a minimal, reproducible sample without private information and steps, not pictures?

Auishik Pyne 5

This is my GetSerialization method (below code snippet). This method is being invoked and redirects to windows homepage if the password matches the set-up password in Windows sign-in options.
But I want to authenticate with custom logic and if successful it will redirect to the Windows homepage. Is it possible?

HRESULT CSampleCredential::GetSerialization(_Out_ CREDENTIAL_PROVIDER_GET_SERIALIZATION_RESPONSE *pcpgsr,
                                            _Out_ CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION *pcpcs,
                                            _Outptr_result_maybenull_ PWSTR *ppwszOptionalStatusText,
                                            _Out_ CREDENTIAL_PROVIDER_STATUS_ICON *pcpsiOptionalStatusIcon)
{
    HRESULT hr = E_UNEXPECTED;
    *pcpgsr = CPGSR_NO_CREDENTIAL_NOT_FINISHED;
    *ppwszOptionalStatusText = nullptr;
    *pcpsiOptionalStatusIcon = CPSI_NONE;
    ZeroMemory(pcpcs, sizeof(*pcpcs));

    
    if (_fIsLocalUser)
    {
        PWSTR pwzProtectedPassword;
        hr = ProtectIfNecessaryAndCopyPassword(_rgFieldStrings[SFI_PASSWORD], _cpus, &pwzProtectedPassword);
        if (SUCCEEDED(hr))
        {
            PWSTR pszDomain;
            PWSTR pszUsername;
            hr = SplitDomainAndUsername(_pszQualifiedUserName, &pszDomain, &pszUsername);
            if (SUCCEEDED(hr))
            {
                KERB_INTERACTIVE_UNLOCK_LOGON kiul;
                hr = KerbInteractiveUnlockLogonInit(pszDomain, pszUsername, pwzProtectedPassword, _cpus, &kiul);
                if (SUCCEEDED(hr))
                {
                    
                    hr = KerbInteractiveUnlockLogonPack(kiul, &pcpcs->rgbSerialization, &pcpcs->cbSerialization);
                    if (SUCCEEDED(hr))
                    {
                        ULONG ulAuthPackage;
                        hr = RetrieveNegotiateAuthPackage(&ulAuthPackage);
                        if (SUCCEEDED(hr))
                        {
                            pcpcs->ulAuthenticationPackage = ulAuthPackage;
                            pcpcs->clsidCredentialProvider = CLSID_CSample;
                            
                            *pcpgsr = CPGSR_RETURN_CREDENTIAL_FINISHED;
                        }
                    }
                }
                CoTaskMemFree(pszDomain);
                CoTaskMemFree(pszUsername);
            }
            CoTaskMemFree(pwzProtectedPassword);
        }
    }

1 answer

Xiaopo Yang - MSFT 12,726 Reputation points Microsoft Vendor

2024-08-26T06:29:49.9166667+00:00

Hello @Auishik Pyne,

As this issue is complex, you can open a Windows SDK incident at https://developer.microsoft.com/en-us/windows/support/?tabs=Contact-us so that our engineer can work with you closely and please choose the 'Security Development - Credential provider API' for this issue. In-addition, if the support engineer determines that the issue is the result of a bug the service request will be a no-charge case and you won't be charged.
Please sign in to rate this answer.
Auishik Pyne 5 Reputation points

2024-09-01T06:05:57.7066667+00:00

Got this. I am unable to proceed further.

Xiaopo Yang - MSFT 12,726 Reputation points Microsoft Vendor

2024-09-02T01:00:59.14+00:00

@Auishik Pyne, you may change your account profile 's country to America for a workaround in order to open a Windows SDK incident.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to Implement an Additional Biometric Layer After Basic Authentication in Windows Using a Custom Credential Provider?

1 answer

Your answer