DCOM Interface Call fails with Kerberos

TRoll 0 Reputation points
2024-05-02T16:34:09.79+00:00

We try to move one of our current DCOM Applications that Impersonates a Client from NTLM over to Kerberos. So I tryed to get a minimal Example running.

I Init the Server and Client as follows:

CoInitializeSecurity(NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_MUTUAL_AUTH, NULL);

Then I create the Remote Server from the Client via:

COSERVERINFO serverInfo;
ZeroMemory(&serverInfo, sizeof(COSERVERINFO));

COAUTHINFO athn;
ZeroMemory(&athn, sizeof(COAUTHINFO));

athn.dwAuthnLevel = RPC_C_AUTHN_LEVEL_PKT_PRIVACY;
athn.dwAuthnSvc = RPC_C_AUTHN_GSS_KERBEROS;
athn.dwAuthzSvc = RPC_C_AUTHZ_DEFAULT;
athn.dwCapabilities = EOAC_MUTUAL_AUTH;
athn.dwImpersonationLevel = RPC_C_IMP_LEVEL_IMPERSONATE;
athn.pAuthIdentityData = NULL;
athn.pwszServerPrincName = L"HOST/<FQDN>";

serverInfo.pwszName = L"<FQDN>";
serverInfo.pAuthInfo = &athn;
serverInfo.dwReserved1 = 0;
serverInfo.dwReserved2 = 0;

MULTI_QI qi = {&IID_ITestKerbAuth, NULL, S_OK};


HRESULT hr = CoCreateInstanceEx(CLSID_TestKerbAuth, NULL, CLSCTX_REMOTE_SERVER , &serverInfo, 1, &qi);

And after that I try to call the Interface:

if (SUCCEEDED(qi.hr)) {
    ITestKerbAuth* pMyInterface = reinterpret_cast<ITestKerbAuth*>(qi.pItf);
    hr = pMyInterface->TestCall();
    pMyInterface->Release();
}

If I Configure the Application Identity via dcomcnfg with a system Account, a Specific User Account or for the interactive User everything works fine. But if I try to set the Application Identity to Launching User, I get:

Error: 80070721 A security package specific error occurred.

The Initial logon to start the Server still succeeds, but all following calls to the Interface fail with the above mentioned Error. If I dont disable NTLM, DCOM is able to fallback to NTLMv2 to call the Interface.

I already tried to set a Service Specific SPN, enabled all the login for Kerberos, enabled logon auditing, tried to call with administrator Privileges, but still have no clue what exactly is wrong.

Can anyone provide any input on how to debug or troubleshoot this issue?

Thanks!

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
11,963 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,546 questions
C++
C++
A high-level, general-purpose programming language, created as an extension of the C programming language, that has object-oriented, generic, and functional features in addition to facilities for low-level memory manipulation.
3,822 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.