Security Support Provider Interface (SSPI) is an API used by Microsoft Windows systems to perform a variety of security-related operations such as authentication. SSPI functions as a common interface to several Security Support Providers (SSPs): A Security Support Provider is a dynamic-link library (DLL) that makes one or more security packages available to applications.
Questions tagged [sspi]
3 questions
33
votes
4 answers
What attacks, if any, are possible against Security Support Provider Interface (SSPI)?
I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various authentication mechanisms (e.g. NTLM, Kerberos, …
Polynomial
- 132,208
- 43
- 298
- 379
5
votes
1 answer
Is running IIS application pools as a domain user considered bad practice?
I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about.
The scenario is that your webservers are being joined to the domain to make administration easier. Then, if we run the website as a…
Martin
- 303
- 3
- 8
2
votes
0 answers
Web API authentication with Kerberos
We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via web API.
Getting Kerberos ticket once with…
E. Vakili
- 121
- 3