Credential Providers simplified pt1

GINA is dead.... the main reason is the fact that having more than one GINA on a system was difficult. 
Yes, chaining multiple GINA DLL's was a possibility but it really required at least one of the GINA providers to be aware of the other and trying to chain 3 different GINAs was still cumbersome.

An additional factor was that the GINA had effectively became a single point of failure for the OS; if one GINA in the chain failed then all the other GINAs in the chain would fail with it.

Those are the two main limitations Credendial Providers were designed to address....to make it easier for multiple logon providers to co-exist on the same machine without conflicts and to make sure that even if one Credential Provider fails then it only affects that particular CP and doesn't drag the whole system down with it.

Writing and installing your own CP is fairly easy (See http://msdn.microsoft.com/en-us/magazine/cc163489.aspx for example), however what needs to be kept in mind is that CP's are only supposed to be used for gathering credentials and passing them on.

In short; Credential Providers are more robust and secure than GINA providers at the expense of being more limited by which operations they can and are intended to perform on the system.

 

Further details:

MSDN CredProv sample:
http://msdn.microsoft.com/en-us/magazine/cc163489.aspx

Winlogon and Credential Providers
http://msdn.microsoft.com/en-us/library/bb648647(VS.85).aspx

Thoughts on Single Sign On and Credential Providers
http://blogs.technet.com/b/ad/archive/2009/05/26/thoughts-on-single-sign-on-and-credential-providers.aspx

Credential Provider Architecture
http://technet.microsoft.com/en-us/library/ff404303(WS.10).aspx

Winlogon and GINA
http://msdn.microsoft.com/en-us/library/aa380543(VS.85).aspx

How [legacy GINA arctitecture] Interactive Logon Works
http://technet.microsoft.com/en-us/library/cc780332(WS.10).aspx

Gina/Ginastub/Ginahook Dll Does Not Work On Post Winxp
http://support.microsoft.com/kb/2214085