wodSSHServer ActiveX Control - LoginGSSAPI Method
 LoginGSSAPI Method
      
 

Description

Called when user wants to authenticate to the server using Kerberos GSSAPI mechanism.


Return Type

None  


Syntax

object.LoginGSSAPI Owner, User, Login, TokenData, Action



The LoginGSSAPI Method syntax has these parts:

Part Description
object An expression evaluating to an object of type wodSSHD-Notifications.
Owner A wodSSHDCom object. Instance of wodSSHServer that called this notification method.
User A SSHUser object. Reference to user who send his login information.
Login A String value. Holds login info entered by the user.
TokenData A String value. Holds exported security context data.
Action A SSHActions enumeration, as described in settings. Return variable you should set to Allow or Deny, depending if you will allow or deny access for the user.

Settings

The settings for Action are:

Constant Value Description
 Deny 0 Deny execution of the action.
 Allow 1 Allow to execute action.

Remarks

This method is called only if you implemented IwodSSHNotify interface in your application, and wodSSHD.Notification property has received reference to instance of your implementation.

LoginGSSAPI notification method is called when the client connects and tries to authenticate with the server using external Kerberos server, and GSSAPI authentication mechanism. If Kerberos authentication is successful, wodSSHServer calls notification method for you to finally decide if you will let user connect or not. While doing so, you can even use TokenData argument which keeps base64 encoded security context data exported using ExportSecurityContext API. You can use this in your application by providing that data to ImportSecurityContext API.

Due to limitations, Kerberos GSSAPI authentication mechanism can be (successfully) used only when your application runs as windows service, under LocalSystem account. When run as regular user account (even with Administrative privileges) GSSAPI always fails as result of API calls.

By default, Action variable is set to Allow - since Kerberos server already allowed access.