Implementing Master Key Protection in a LAP
A version of this page is also available for
4/8/2010
You can implement master key protection in LAPs that collect verification data from the user but that do not persist the data. An example of a LAP that does not persist user data is a password LAP, for which the user data is the password. For more information about creating a LAP with master key protection, see Creating a LAP. A sample password LAP is available, as described in LASS Samples.
Master key protection is applicable only if the following conditions apply:
- The LAP supports master key protection.
- System powerup, represented by the StartUI AE_STARTUI event, is protected with the LASS AE_EVERYTIME event, using a policy of every time. This policy indicates that every time the operating system starts up, VerifyUser will be called. The policy is set when the AEFrequencyType and AEFrequencyValue registry subkeys are both set to 0. For more information about setting an AE policy, see Setting an AE Policy.
When master key protection is applicable, VerifyUser implicitly sets the VU_HANDLE_MASTER_KEY flag when it is called by StartUI. In addition, any application call to LASSReloadConfig will implicitly invoke VerifyUser with the VU_HANDLE_MASTER_KEY flag.
To enable master key protection, you must implement the following details in your LAP DLL entry points.
- InitLAP (function)
Set the capabilities member in InitLap (structure) to include the LAP_CAPABILITIES_MASTER_KEY flag. - DeinitLAP
Remove the master key protection when the LAP is unloaded. - LAPCreateEnrollmentConfigDialog
Start this function when the user is enrolled via an application call to CreateEnrollmentConfigDialog. Apply master key protection only if the caller specifies the VU_HANDLE_MASTER_KEY flag in the dwOptions parameter. Remove master key protection when the LAP is unloaded. - VerifyUser (LAP)
Apply master key protection only if the caller specifies the VU_HANDLE_MASTER_KEY flag in the dwOptions parameter.