' ########################################################################################
' Microsoft Windows
' File: Sspi.inc
' Contents: Security Support Provider Interface prototypes and structure definitions
' Copyright (c) 2011 Jos? Roca
' Portions Copyright (c) Microsoft Corporation.
' All Rights Reserved.
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
' EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
' MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
' ########################################################################################
' NOTE: The parameters of type TimeStamp, CredHandle, CtxtHandle have been declared
' AS ANY to allow to pass an structure or a QUAD.
#IF NOT %DEF(PBX_Sspi_PBI)
#DEFINE PBX_Sspi_PBI
%EQUATE `SSPI_INC = 1
#INCLUDE ONCE "Legacy/Platform/wincred.inc"
#INCLUDE ONCE "Legacy/Platform/NTSecAPI.inc"
#INCLUDE ONCE "Legacy/System/sdkddkver.inc"
'#ifndef __SSPI_H__
'#define __SSPI_H__
'#if _MSC_VER > 1000
'#pragma once
'#endif
'#ifdef __cplusplus
'extern "C" {
'#endif
'//
'// Determine environment:
'//
'#IF %DEF(%SECURITY_WIN32)
'%ISSP_LEVEL = 32
'%ISSP_MODE = 1
'#ENDIF ' // SECURITY_WIN32
'#IF %DEF(%SECURITY_KERNEL)
'%ISSP_LEVEL = 32 ' // ntifs
'//
'// SECURITY_KERNEL trumps SECURITY_WIN32. Undefine ISSP_MODE so that
'// we don't get redefine errors.
'//
'#ifdef ISSP_MODE
'#undef ISSP_MODE
'#endif
'%ISSP_MODE = 0 ' // ntifs
'#ENDIF ' // SECURITY_KERNEL
'#ifdef SECURITY_MAC
'#define ISSP_LEVEL 32
'#define ISSP_MODE 1
'#endif // SECURITY_MAC
'#ifndef ISSP_LEVEL
'#error You must define one of SECURITY_WIN32, SECURITY_KERNEL, or
'#error SECURITY_MAC
'#endif // !ISSP_LEVEL
'//
'// Now, define platform specific mappings:
'//
'#if defined(_NO_KSECDD_IMPORT_)
'#define KSECDDDECLSPEC
'#else
'#define KSECDDDECLSPEC __declspec(dllimport)
'#endif
'typedef WCHAR SEC_WCHAR;
'typedef CHAR SEC_CHAR;
'#ifndef __SECSTATUS_DEFINED__
'typedef LONG SECURITY_STATUS;
'#define __SECSTATUS_DEFINED__
'#endif
'#define SEC_TEXT TEXT
'#define SEC_FAR
'#define SEC_ENTRY __stdcall
'//
'// Decide what a string - 32 bits only since for 16 bits it is clear.
'//
'#ifdef UNICODE
'typedef SEC_WCHAR * SECURITY_PSTR;
'typedef CONST SEC_WCHAR * SECURITY_PCSTR;
'#else // UNICODE
'typedef SEC_CHAR * SECURITY_PSTR;
'typedef CONST SEC_CHAR * SECURITY_PCSTR;
'#endif // UNICODE
'//
'// Equivalent string for rpcrt:
'//
'#define __SEC_FAR
'//
'// Okay, security specific types:
'//
#IF NOT %DEF(%SECHANDLE_DEFINED)
%EQUATE `SECHANDLE_DEFINED = 1
' // Size = 8 bytes
TYPE SecHandle DWORD
 dwLower AS DWORD ' ULONG_PTR
 dwUpper AS DWORD ' ULONG_PTR
END TYPE
#ENDIF
'#define SecInvalidateHandle( x ) \
' ((PSecHandle) x)->dwLower = ((ULONG_PTR) ((INT_PTR)-1)) ; \
' ((PSecHandle) x)->dwUpper = ((ULONG_PTR) ((INT_PTR)-1)) ; \
SUB SecInvalidateHandle (BYREF x AS SecHandle)
 x.dwLower = &HFFFFFFFF
 x.dwUpper = &HFFFFFFFF
END SUB
'#define SecIsValidHandle( x ) \
' ( ( ((PSecHandle) x)->dwLower != ((ULONG_PTR) ((INT_PTR) -1 ))) && \
' ( ((PSecHandle) x)->dwUpper != ((ULONG_PTR) ((INT_PTR) -1 ))) )
FUNCTION SecIsValidHandle (BYREF x AS SecHandle) AS LONG
 FUNCTION = ((x.dwLower <> &HFFFFFFFF) AND (x.dwUpper <> &HFFFFFFFF))
END FUNCTION
'//
'// pseudo handle value: the handle has already been deleted
'//
'#define SEC_DELETED_HANDLE ((ULONG_PTR) (-2))
%EQUATE `SEC_DELETED_HANDLE = &HFFFFFFFE
'typedef SecHandle CredHandle;
'typedef PSecHandle PCredHandle;
' // Size = 8 bytes
TYPE CredHandle DWORD
 dwLower AS DWORD ' ULONG_PTR
 dwUpper AS DWORD ' ULONG_PTR
END TYPE
'typedef SecHandle CtxtHandle;
'typedef PSecHandle PCtxtHandle;
' // Size = 8 bytes
TYPE CtxtHandle DWORD
 dwLower AS DWORD ' ULONG_PTR
 dwUpper AS DWORD ' ULONG_PTR
END TYPE
'# ifdef WIN32_CHICAGO
'typedef unsigned __int64 QWORD;
'typedef QWORD SECURITY_INTEGER, *PSECURITY_INTEGER;
'#define SEC_SUCCESS(Status) ((Status) >= 0)
'# elif defined(_NTDEF_) || defined(_WINNT_)
'typedef LARGE_INTEGER _SECURITY_INTEGER, SECURITY_INTEGER, *PSECURITY_INTEGER; // ntifs
'# else // _NTDEF_ || _WINNT_
'typedef struct _SECURITY_INTEGER
'{
' unsigned long LowPart;
' long HighPart;
'} SECURITY_INTEGER, *PSECURITY_INTEGER;
'# endif // _NTDEF_ || _WINNT_
'# ifndef SECURITY_MAC
'typedef SECURITY_INTEGER TimeStamp; // ntifs
'typedef SECURITY_INTEGER * PTimeStamp; // ntifs
'# else // SECURITY_MAC
'typedef unsigned long TimeStamp;
'typedef unsigned long * PTimeStamp;
'# endif // SECUIRT_MAC
FUNCTION SEC_SUCCESS (BYVAL nStatus AS LONG) AS LONG
 FUNCTION = -(nStatus >= 0)
END FUNCTION
' // Size = 8 bytes
TYPE SECURITY_INTEGER DWORD
 LowPart AS DWORD ' unsigned long
 HighPart AS LONG ' long
END TYPE
'//
'// If we are in 32 bit mode, define the SECURITY_STRING structure,
'// as a clone of the base UNICODE_STRING structure. This is used
'// internally in security components, an as the string interface
'// for kernel components (e.g. FSPs)
'//
'# ifndef _NTDEF_
'typedef struct _SECURITY_STRING {
' unsigned short Length;
' unsigned short MaximumLength;
'# ifdef MIDL_PASS
' [size_is(MaximumLength / 2), length_is(Length / 2)]
'# endif // MIDL_PASS
' unsigned short * Buffer;
''} SECURITY_STRING, * PSECURITY_STRING;
'# else // _NTDEF_
'typedef UNICODE_STRING SECURITY_STRING, *PSECURITY_STRING; // ntifs
'# endif // _NTDEF_
' // Size = 8 bytes
TYPE SECURITY_STRING WORD
 Length AS WORD ' unsigned short
 MaximumLength AS WORD ' unsigned short
 Buffer AS WORD PTR ' unsigned short *
END TYPE
'//
'// SecPkgInfo structure
'//
'// Provides general information about a security provider
'//
' // Size = 20 bytes
TYPE SecPkgInfoW WORD
 fCapabilities AS DWORD ' unsigned long // Capability bitmask
 wVersion AS WORD ' unsigned short // Version of driver
 wRPCID AS WORD ' unsigned short // ID for RPC Runtime
 cbMaxToken AS DWORD ' unsigned long // Size of authentication token (max)
 Name AS WSTRINGZ PTR ' SEC_WCHAR * // Text name
 Comment AS WSTRINGZ PTR ' SEC_WCHAR * // Comment
END TYPE
' // Size = 20 bytes
TYPE SecPkgInfoA WORD
 fCapabilities AS DWORD ' unsigned long // Capability bitmask
 wVersion AS WORD ' unsigned short // Version of driver
 wRPCID AS WORD ' unsigned short // ID for RPC Runtime
 cbMaxToken AS DWORD ' unsigned long // Size of authentication token (max)
 Name AS ASCIIZ PTR ' SEC_CHAR * // Text name
 Comment AS ASCIIZ PTR ' SEC_CHAR * // Comment
END TYPE
MACRO SecPkgInfo = SecPkgInfoA
'//
'// Security Package Capabilities
'//
%EQUATE `SECPKG_FLAG_INTEGRITY = &H00000001 ' // Supports integrity on messages
%EQUATE `SECPKG_FLAG_PRIVACY = &H00000002 ' // Supports privacy (confidentiality)
%EQUATE `SECPKG_FLAG_TOKEN_ONLY = &H00000004 ' // Only security token needed
%EQUATE `SECPKG_FLAG_DATAGRAM = &H00000008 ' // Datagram RPC support
%EQUATE `SECPKG_FLAG_CONNECTION = &H00000010 ' // Connection oriented RPC support
%EQUATE `SECPKG_FLAG_MULTI_REQUIRED = &H00000020 ' // Full 3-leg required for re-auth.
%EQUATE `SECPKG_FLAG_CLIENT_ONLY = &H00000040 ' // Server side functionality not available
%EQUATE `SECPKG_FLAG_EXTENDED_ERROR = &H00000080 ' // Supports extended error msgs
%EQUATE `SECPKG_FLAG_IMPERSONATION = &H00000100 ' // Supports impersonation
%EQUATE `SECPKG_FLAG_ACCEPT_WIN32_NAME = &H00000200 ' // Accepts Win32 names
%EQUATE `SECPKG_FLAG_STREAM = &H00000400 ' // Supports stream semantics
%EQUATE `SECPKG_FLAG_NEGOTIABLE = &H00000800 ' // Can be used by the negotiate package
%EQUATE `SECPKG_FLAG_GSS_COMPATIBLE = &H00001000 ' // GSS Compatibility Available
%EQUATE `SECPKG_FLAG_LOGON = &H00002000 ' // Supports common LsaLogonUser
%EQUATE `SECPKG_FLAG_ASCII_BUFFERS = &H00004000 ' // Token Buffers are in ASCII
%EQUATE `SECPKG_FLAG_FRAGMENT = &H00008000 ' // Package can fragment to fit
%EQUATE `SECPKG_FLAG_MUTUAL_AUTH = &H00010000 ' // Package can perform mutual authentication
%EQUATE `SECPKG_FLAG_DELEGATION = &H00020000 ' // Package can delegate
%EQUATE `SECPKG_FLAG_READONLY_WITH_CHECKSUM = &H00040000 ' // Package can delegate
%EQUATE `SECPKG_FLAG_RESTRICTED_TOKENS = &H00080000 ' // Package supports restricted callers
%EQUATE `SECPKG_FLAG_NEGO_EXTENDER = &H00100000 ' // this package extends SPNEGO, there is at most one
%EQUATE `SECPKG_FLAG_NEGOTIABLE2 = &H00200000 ' // this package is negotiated under the NegoExtender
%EQUATE `SECPKG_ID_NONE = &HFFFF
'//
'// SecBuffer
'//
'// Generic memory descriptors for buffers passed in to the security
'// API
'//
' // Size = 12 bytes
TYPE SecBuffer DWORD
 cbBuffer AS DWORD ' unsigned long // Size of the buffer, in bytes
 BufferType AS DWORD ' unsigned long // Type of the buffer (below)
 pvBuffer AS DWORD
END TYPE
' // Size = 12 bytes
TYPE SecBufferDesc DWORD
 ulVersion AS DWORD ' unsigned long // Version number
 cBuffers AS DWORD ' unsigned long // Number of buffers
 pBuffers AS SecBuffer PTR ' PSecBuffer // Pointer to array of buffers
END TYPE
%EQUATE `SECBUFFER_VERSION = 0
%EQUATE `SECBUFFER_EMPTY = 0 ' // Undefined, replaced by provider
%EQUATE `SECBUFFER_DATA = 1 ' // Packet data
%EQUATE `SECBUFFER_TOKEN = 2 ' // Security token
%EQUATE `SECBUFFER_PKG_PARAMS = 3 ' // Package specific parameters
%EQUATE `SECBUFFER_MISSING = 4 ' // Missing Data indicator
%EQUATE `SECBUFFER_EXTRA = 5 ' // Extra data
%EQUATE `SECBUFFER_STREAM_TRAILER = 6 ' // Security Trailer
%EQUATE `SECBUFFER_STREAM_HEADER = 7 ' // Security Header
%EQUATE `SECBUFFER_NEGOTIATION_INFO = 8 ' // Hints from the negotiation pkg
%EQUATE `SECBUFFER_PADDING = 9 ' // non-data padding
%EQUATE `SECBUFFER_STREAM = 10 ' // whole encrypted message
%EQUATE `SECBUFFER_MECHLIST = 11
%EQUATE `SECBUFFER_MECHLIST_SIGNATURE = 12
%EQUATE `SECBUFFER_TARGET = 13 ' // obsolete
%EQUATE `SECBUFFER_CHANNEL_BINDINGS = 14
%EQUATE `SECBUFFER_CHANGE_PASS_RESPONSE = 15
%EQUATE `SECBUFFER_TARGET_HOST = 16
%EQUATE `SECBUFFER_ALERT = 17
%EQUATE `SECBUFFER_ATTRMASK = &HF0000000
%EQUATE `SECBUFFER_READONLY = &H80000000 ' // Buffer is read-only, no checksum
%EQUATE `SECBUFFER_READONLY_WITH_CHECKSUM = &H10000000 ' // Buffer is read-only, and checksummed
%EQUATE `SECBUFFER_RESERVED = &H60000000 ' // Flags reserved to security system
' // Size = 16 bytes
TYPE SEC_NEGOTIATION_INFO DWORD
 Size AS DWORD ' unsigned long // Size of this structure
 NameLength AS DWORD ' unsigned long // Length of name hint
 Name AS WSTRINGZ PTR ' SEC_WCHAR * // Name hint
 Reserved AS DWORD ' void * // Reserved
END TYPE
' // Size = 32 bytes
TYPE SEC_CHANNEL_BINDINGS DWORD
 dwInitiatorAddrType AS DWORD ' unsigned long
 cbInitiatorLength AS DWORD ' unsigned long
 dwInitiatorOffset AS DWORD ' unsigned long
 dwAcceptorAddrType AS DWORD ' unsigned long
 cbAcceptorLength AS DWORD ' unsigned long
 dwAcceptorOffset AS DWORD ' unsigned long
 cbApplicationDataLength AS DWORD ' unsigned long
 dwApplicationDataOffset AS DWORD ' unsigned long
END TYPE
'//
'// Data Representation Constant:
'//
%EQUATE `SECURITY_NATIVE_DREP = &H00000010
%EQUATE `SECURITY_NETWORK_DREP = &H00000000
'//
'// Credential Use Flags
'//
%EQUATE `SECPKG_CRED_INBOUND = &H00000001
%EQUATE `SECPKG_CRED_OUTBOUND = &H00000002
%EQUATE `SECPKG_CRED_BOTH = &H00000003
%EQUATE `SECPKG_CRED_DEFAULT = &H00000004
%EQUATE `SECPKG_CRED_RESERVED = &HF0000000
'//
'// SSP SHOULD prompt the user for credentials/consent, independent
'// of whether credentials to be used are the 'logged on' credentials
'// or retrieved from credman.
'//
'// An SSP may choose not to prompt, however, in circumstances determined
'// by the SSP.
'//
%EQUATE `SECPKG_CRED_AUTOLOGON_RESTRICTED = &H00000010
'//
'// auth will always fail, ISC() is called to process policy data only
'//
%EQUATE `SECPKG_CRED_PROCESS_POLICY_ONLY = &H00000020
'//
'// InitializeSecurityContext Requirement and return flags:
'//
%EQUATE `ISC_REQ_DELEGATE = &H00000001
%EQUATE `ISC_REQ_MUTUAL_AUTH = &H00000002
%EQUATE `ISC_REQ_REPLAY_DETECT = &H00000004
%EQUATE `ISC_REQ_SEQUENCE_DETECT = &H00000008
%EQUATE `ISC_REQ_CONFIDENTIALITY = &H00000010
%EQUATE `ISC_REQ_USE_SESSION_KEY = &H00000020
%EQUATE `ISC_REQ_PROMPT_FOR_CREDS = &H00000040
%EQUATE `ISC_REQ_USE_SUPPLIED_CREDS = &H00000080
%EQUATE `ISC_REQ_ALLOCATE_MEMORY = &H00000100
%EQUATE `ISC_REQ_USE_DCE_STYLE = &H00000200
%EQUATE `ISC_REQ_DATAGRAM = &H00000400
%EQUATE `ISC_REQ_CONNECTION = &H00000800
%EQUATE `ISC_REQ_CALL_LEVEL = &H00001000
%EQUATE `ISC_REQ_FRAGMENT_SUPPLIED = &H00002000
%EQUATE `ISC_REQ_EXTENDED_ERROR = &H00004000
%EQUATE `ISC_REQ_STREAM = &H00008000
%EQUATE `ISC_REQ_INTEGRITY = &H00010000
%EQUATE `ISC_REQ_IDENTIFY = &H00020000
%EQUATE `ISC_REQ_NULL_SESSION = &H00040000
%EQUATE `ISC_REQ_MANUAL_CRED_VALIDATION = &H00080000
%EQUATE `ISC_REQ_RESERVED1 = &H00100000
%EQUATE `ISC_REQ_FRAGMENT_TO_FIT = &H00200000
'// This exists only in Windows Vista and greater
%EQUATE `ISC_REQ_FORWARD_CREDENTIALS = &H00400000
%EQUATE `ISC_REQ_NO_INTEGRITY = &H00800000 ' // honored only by SPNEGO
%EQUATE `ISC_REQ_USE_HTTP_STYLE = &H01000000
%EQUATE `ISC_RET_DELEGATE = &H00000001
%EQUATE `ISC_RET_MUTUAL_AUTH = &H00000002
%EQUATE `ISC_RET_REPLAY_DETECT = &H00000004
%EQUATE `ISC_RET_SEQUENCE_DETECT = &H00000008
%EQUATE `ISC_RET_CONFIDENTIALITY = &H00000010
%EQUATE `ISC_RET_USE_SESSION_KEY = &H00000020
%EQUATE `ISC_RET_USED_COLLECTED_CREDS = &H00000040
%EQUATE `ISC_RET_USED_SUPPLIED_CREDS = &H00000080
%EQUATE `ISC_RET_ALLOCATED_MEMORY = &H00000100
%EQUATE `ISC_RET_USED_DCE_STYLE = &H00000200
%EQUATE `ISC_RET_DATAGRAM = &H00000400
%EQUATE `ISC_RET_CONNECTION = &H00000800
%EQUATE `ISC_RET_INTERMEDIATE_RETURN = &H00001000
%EQUATE `ISC_RET_CALL_LEVEL = &H00002000
%EQUATE `ISC_RET_EXTENDED_ERROR = &H00004000
%EQUATE `ISC_RET_STREAM = &H00008000
%EQUATE `ISC_RET_INTEGRITY = &H00010000
%EQUATE `ISC_RET_IDENTIFY = &H00020000
%EQUATE `ISC_RET_NULL_SESSION = &H00040000
%EQUATE `ISC_RET_MANUAL_CRED_VALIDATION = &H00080000
%EQUATE `ISC_RET_RESERVED1 = &H00100000
%EQUATE `ISC_RET_FRAGMENT_ONLY = &H00200000
'// This exists only in Windows Vista and greater
%EQUATE `ISC_RET_FORWARD_CREDENTIALS = &H00400000
%EQUATE `ISC_RET_USED_HTTP_STYLE = &H01000000
%EQUATE `ISC_RET_NO_ADDITIONAL_TOKEN = &H02000000 ' // *INTERNAL*
%EQUATE `ISC_RET_REAUTHENTICATION = &H08000000 ' // *INTERNAL*
%EQUATE `ASC_REQ_DELEGATE = &H00000001
%EQUATE `ASC_REQ_MUTUAL_AUTH = &H00000002
%EQUATE `ASC_REQ_REPLAY_DETECT = &H00000004
%EQUATE `ASC_REQ_SEQUENCE_DETECT = &H00000008
%EQUATE `ASC_REQ_CONFIDENTIALITY = &H00000010
%EQUATE `ASC_REQ_USE_SESSION_KEY = &H00000020
%EQUATE `ASC_REQ_ALLOCATE_MEMORY = &H00000100
%EQUATE `ASC_REQ_USE_DCE_STYLE = &H00000200
%EQUATE `ASC_REQ_DATAGRAM = &H00000400
%EQUATE `ASC_REQ_CONNECTION = &H00000800
%EQUATE `ASC_REQ_CALL_LEVEL = &H00001000
%EQUATE `ASC_REQ_EXTENDED_ERROR = &H00008000
%EQUATE `ASC_REQ_STREAM = &H00010000
%EQUATE `ASC_REQ_INTEGRITY = &H00020000
%EQUATE `ASC_REQ_LICENSING = &H00040000
%EQUATE `ASC_REQ_IDENTIFY = &H00080000
%EQUATE `ASC_REQ_ALLOW_NULL_SESSION = &H00100000
%EQUATE `ASC_REQ_ALLOW_NON_USER_LOGONS = &H00200000
%EQUATE `ASC_REQ_ALLOW_CONTEXT_REPLAY = &H00400000
%EQUATE `ASC_REQ_FRAGMENT_TO_FIT = &H00800000
%EQUATE `ASC_REQ_FRAGMENT_SUPPLIED = &H00002000
%EQUATE `ASC_REQ_NO_TOKEN = &H01000000
%EQUATE `ASC_REQ_PROXY_BINDINGS = &H04000000
'// SSP_RET_REAUTHENTICATION = &H08000000 // *INTERNAL*
%EQUATE `ASC_REQ_ALLOW_MISSING_BINDINGS = &H10000000
%EQUATE `ASC_RET_DELEGATE = &H00000001
%EQUATE `ASC_RET_MUTUAL_AUTH = &H00000002
%EQUATE `ASC_RET_REPLAY_DETECT = &H00000004
%EQUATE `ASC_RET_SEQUENCE_DETECT = &H00000008
%EQUATE `ASC_RET_CONFIDENTIALITY = &H00000010
%EQUATE `ASC_RET_USE_SESSION_KEY = &H00000020
%EQUATE `ASC_RET_ALLOCATED_MEMORY = &H00000100
%EQUATE `ASC_RET_USED_DCE_STYLE = &H00000200
%EQUATE `ASC_RET_DATAGRAM = &H00000400
%EQUATE `ASC_RET_CONNECTION = &H00000800
%EQUATE `ASC_RET_CALL_LEVEL = &H00002000 ' // skipped 1000 to be like ISC_
%EQUATE `ASC_RET_THIRD_LEG_FAILED = &H00004000
%EQUATE `ASC_RET_EXTENDED_ERROR = &H00008000
%EQUATE `ASC_RET_STREAM = &H00010000
%EQUATE `ASC_RET_INTEGRITY = &H00020000
%EQUATE `ASC_RET_LICENSING = &H00040000
%EQUATE `ASC_RET_IDENTIFY = &H00080000
%EQUATE `ASC_RET_NULL_SESSION = &H00100000
%EQUATE `ASC_RET_ALLOW_NON_USER_LOGONS = &H00200000
%EQUATE `ASC_RET_ALLOW_CONTEXT_REPLAY = &H00400000 ' // deprecated - don't use this flag!!!
%EQUATE `ASC_RET_FRAGMENT_ONLY = &H00800000
%EQUATE `ASC_RET_NO_TOKEN = &H01000000
%EQUATE `ASC_RET_NO_ADDITIONAL_TOKEN = &H02000000 ' // *INTERNAL*
%EQUATE `ASC_RET_NO_PROXY_BINDINGS = &H04000000
'// SSP_RET_REAUTHENTICATION = &H08000000 // *INTERNAL*
%EQUATE `ASC_RET_MISSING_BINDINGS = &H10000000
'//
'// Security Credentials Attributes:
'//
%EQUATE `SECPKG_CRED_ATTR_NAMES = 1
%EQUATE `SECPKG_CRED_ATTR_SSI_PROVIDER = 2
' // Size = 4 bytes
TYPE SecPkgCredentials_NamesW DWORD
 sUserName AS WSTRINGZ PTR ' SEC_WCHAR *
END TYPE
' // Size = 4 bytes
TYPE SecPkgCredentials_NamesA DWORD
 sUserName AS ASCIIZ PTR ' SEC_CHAR *
END TYPE
MACRO SecPkgCredentials_Names = SecPkgCredentials_NamesA
'#if NTDDI_VERSION > NTDDI_WS03
' // Size = 12 bytes
TYPE SecPkgCredentials_SSIProviderW DWORD
 sProviderName AS WSTRINGZ PTR ' SEC_WCHAR *
 ProviderInfoLength AS DWORD ' unsigned long
 ProviderInfo AS ASCIIZ PTR ' char *
END TYPE
'#endif // End W2k3SP1 and greater
' // Size = 12 bytes
TYPE SecPkgCredentials_SSIProviderA DWORD
 sProviderName AS ASCIIZ PTR ' SEC_CHAR *
 ProviderInfoLength AS DWORD ' unsigned long
 ProviderInfo AS ASCIIZ PTR ' char *
END TYPE
MACRO SecPkgCredentials_SSIProvider = SecPkgCredentials_SSIProviderA
'//
'// Security Context Attributes:
'//
%EQUATE `SECPKG_ATTR_SIZES = 0
%EQUATE `SECPKG_ATTR_NAMES = 1
%EQUATE `SECPKG_ATTR_LIFESPAN = 2
%EQUATE `SECPKG_ATTR_DCE_INFO = 3
%EQUATE `SECPKG_ATTR_STREAM_SIZES = 4
%EQUATE `SECPKG_ATTR_KEY_INFO = 5
%EQUATE `SECPKG_ATTR_AUTHORITY = 6
%EQUATE `SECPKG_ATTR_PROTO_INFO = 7
%EQUATE `SECPKG_ATTR_PASSWORD_EXPIRY = 8
%EQUATE `SECPKG_ATTR_SESSION_KEY = 9
%EQUATE `SECPKG_ATTR_PACKAGE_INFO = 10
%EQUATE `SECPKG_ATTR_USER_FLAGS = 11
%EQUATE `SECPKG_ATTR_NEGOTIATION_INFO = 12
%EQUATE `SECPKG_ATTR_NATIVE_NAMES = 13
%EQUATE `SECPKG_ATTR_FLAGS = 14
'// These attributes exist only in Win XP and greater
%EQUATE `SECPKG_ATTR_USE_VALIDATED = 15
%EQUATE `SECPKG_ATTR_CREDENTIAL_NAME = 16
%EQUATE `SECPKG_ATTR_TARGET_INFORMATION = 17
%EQUATE `SECPKG_ATTR_ACCESS_TOKEN = 18
'// These attributes exist only in Win2K3 and greater
%EQUATE `SECPKG_ATTR_TARGET = 19
%EQUATE `SECPKG_ATTR_AUTHENTICATION_ID = 20
'// These attributes exist only in Win2K3SP1 and greater
%EQUATE `SECPKG_ATTR_LOGOFF_TIME = 21
'//
'// win7 or greater
'//
%EQUATE `SECPKG_ATTR_NEGO_KEYS = 22
%EQUATE `SECPKG_ATTR_PROMPTING_NEEDED = 24
%EQUATE `SECPKG_ATTR_UNIQUE_BINDINGS = 25
%EQUATE `SECPKG_ATTR_ENDPOINT_BINDINGS = 26
%EQUATE `SECPKG_ATTR_CLIENT_SPECIFIED_TARGET = 27
%EQUATE `SECPKG_ATTR_LAST_CLIENT_TOKEN_STATUS = 30
%EQUATE `SECPKG_ATTR_NEGO_PKG_INFO = 31 ' // contains nego info of packages
%EQUATE `SECPKG_ATTR_NEGO_STATUS = 32 ' // contains the last error
%EQUATE `SECPKG_ATTR_CONTEXT_DELETED = 33 ' // a context has been deleted
%EQUATE `SECPKG_ATTR_SUBJECT_SECURITY_ATTRIBUTES = 128
' // Size = 4 bytes
TYPE SecPkgContext_SubjectAttributes DWORD
 AttributeInfo AS DWORD ' void * ' // contains a PAUTHZ_SECURITY_ATTRIBUTES_INFORMATION structure
END TYPE
%EQUATE `SECPKG_ATTR_NEGO_INFO_FLAG_NO_KERBEROS = &H1
%EQUATE `SECPKG_ATTR_NEGO_INFO_FLAG_NO_NTLM = &H2
'//
'// types of credentials, used by SECPKG_ATTR_PROMPTING_NEEDED
'//
' enum SECPKG_CRED_CLASS
%EQUATE `SecPkgCredClass_None = 0 ' // no creds
%EQUATE `SecPkgCredClass_Ephemeral = 10 ' // logon creds
%EQUATE `SecPkgCredClass_PersistedGeneric = 20 ' // saved creds, not target specific
%EQUATE `SecPkgCredClass_PersistedSpecific = 30 ' // saved creds, target specific
%EQUATE `SecPkgCredClass_Explicit = 40 ' // explicitly supplied creds
' // Size = 8 bytes
TYPE SecPkgContext_CredInfo DWORD
 CredClass AS LONG ' SECPKG_CRED_CLASS
 IsPromptingNeeded AS DWORD ' unsigned long
END TYPE
' // Size = 4 bytes
TYPE SecPkgContext_NegoPackageInfo DWORD
 PackageMask AS DWORD ' unsigned long
END TYPE
' // Size = 4 bytes
TYPE SecPkgContext_NegoStatus DWORD
 LastStatus AS DWORD ' unsigned long
END TYPE
' // Size = 16 bytes
TYPE SecPkgContext_Sizes DWORD
 cbMaxToken AS DWORD ' unsigned long
 cbMaxSignature AS DWORD ' unsigned long
 cbBlockSize AS DWORD ' unsigned long
 cbSecurityTrailer AS DWORD ' unsigned long
END TYPE
' // Size = 20 bytes
TYPE SecPkgContext_StreamSizes DWORD
 cbHeader AS DWORD ' unsigned long
 cbTrailer AS DWORD ' unsigned long
 cbMaximumMessage AS DWORD ' unsigned long
 cBuffers AS DWORD ' unsigned long
 cbBlockSize AS DWORD ' unsigned long
END TYPE
' // Size = 4 bytes
TYPE SecPkgContext_NamesW DWORD
 sUserName AS WSTRINGZ PTR ' SEC_WCHAR *
END TYPE
' enum _SECPKG_ATTR_LCT_STATUS
%EQUATE `SecPkgAttrLastClientTokenYes = 0
%EQUATE `SecPkgAttrLastClientTokenNo = 1
%EQUATE `SecPkgAttrLastClientTokenMaybe = 2
' // Size = 4 bytes
TYPE SecPkgContext_LastClientTokenStatus DWORD
 LastClientTokenStatus AS LONG ' SECPKG_ATTR_LCT_STATUS
END TYPE
' // Size = 4 bytes
TYPE SecPkgContext_NamesA DWORD
 sUserName AS ASCIIZ PTR ' SEC_CHAR *
END TYPE
MACRO SecPkgContext_Names = SecPkgContext_NamesA
' // Size = 16 bytes
TYPE SecPkgContext_Lifespan QWORD
 tsStart AS QUAD ' TimeStamp
 tsExpiry AS QUAD ' TimeStamp
END TYPE
' // Size = 8 bytes
TYPE SecPkgContext_DceInfo DWORD
 AuthzSvc AS DWORD ' unsigned long
 pPac AS DWORD ' void *
END TYPE
' // Size = 20 bytes
TYPE SecPkgContext_KeyInfoA DWORD
 sSignatureAlgorithmName AS ASCIIZ PTR ' SEC_CHAR *
 sEncryptAlgorithmName AS ASCIIZ PTR ' SEC_CHAR *
 KeySize AS DWORD ' unsigned long
 SignatureAlgorithm AS DWORD ' unsigned long
 EncryptAlgorithm AS DWORD ' unsigned long
END TYPE
' // Size = 20 bytes
TYPE SecPkgContext_KeyInfoW DWORD
 sSignatureAlgorithmName AS WSTRINGZ PTR ' SEC_WCHAR *
 sEncryptAlgorithmName AS WSTRINGZ PTR ' SEC_WCHAR *
 KeySize AS DWORD ' unsigned long
 SignatureAlgorithm AS DWORD ' unsigned long
 EncryptAlgorithm AS DWORD ' unsigned long
END TYPE
MACRO SecPkgContext_KeyInfo = SecPkgContext_KeyInfoA
' // Size = 4 bytes
TYPE SecPkgContext_AuthorityA DWORD
 sAuthorityName AS ASCIIZ PTR ' SEC_CHAR *
END TYPE
' // Size = 4 bytes
TYPE SecPkgContext_AuthorityW DWORD
 sAuthorityName AS WSTRINGZ PTR ' SEC_WCHAR *
END TYPE
MACRO SecPkgContext_Authority = SecPkgContext_AuthorityA
' // Size = 12 bytes
TYPE SecPkgContext_ProtoInfoA DWORD
 sProtocolName AS ASCIIZ PTR ' SEC_CHAR *
 majorVersion AS DWORD ' unsigned long
 minorVersion AS DWORD ' unsigned long
END TYPE
' // Size = 12 bytes
TYPE SecPkgContext_ProtoInfoW DWORD
 sProtocolName AS WSTRINGZ PTR ' SEC_WCHAR *
 majorVersion AS DWORD ' unsigned long
 minorVersion AS DWORD ' unsigned long
END TYPE
MACRO SecPkgContext_ProtoInfo = SecPkgContext_ProtoInfoA
' // Size = 8 bytes
TYPE SecPkgContext_PasswordExpiry QWORD
 tsPasswordExpires AS QUAD ' TimeStamp
END TYPE
'#if NTDDI_VERSION > NTDDI_WS03
' // Size = 8 bytes
TYPE SecPkgContext_LogoffTime QWORD
 tsLogoffTime AS QUAD ' TimeStamp
END TYPE
'#endif // Greater than Windows Server 2003 RTM (SP1 and greater contains this)
' // Size = 8 bytes
TYPE SecPkgContext_SessionKey DWORD
 SessionKeyLength AS DWORD ' unsigned long
 SessionKey AS BYTE PTR ' unsigned char *
END TYPE
'// used by nego2
' // Size = 24 bytes
TYPE SecPkgContext_NegoKeys DWORD
 KeyType AS DWORD ' unsigned long
 KeyLength AS WORD ' unsigned short
 KeyValue AS BYTE PTR
 VerifyKeyType AS DWORD ' unsigned long
 VerifyKeyLength AS WORD ' unsigned short
 VerifyKeyValue AS BYTE PTR
END TYPE
' // Size = 4 bytes
TYPE SecPkgContext_PackageInfoW DWORD
 PackageInfo AS SecPkgInfoW PTR ' PSecPkgInfoW
END TYPE
' // Size = 4 bytes
TYPE SecPkgContext_PackageInfoA DWORD
 PackageInfo AS SecPkgInfoA PTR ' PSecPkgInfoA
END TYPE
MACRO SecPkgContext_PackageInfo = SecPkgContext_PackageInfoA
' // Size = 4 bytes
TYPE SecPkgContext_UserFlags DWORD
 UserFlags AS DWORD ' unsigned long
END TYPE
' // Size = 4 bytes
TYPE SecPkgContext_Flags DWORD
 Flags AS DWORD ' unsigned long
END TYPE
' // Size = 8 bytes
TYPE SecPkgContext_NegotiationInfoA DWORD
 PackageInfo AS SecPkgInfoA PTR ' PSecPkgInfoA
 NegotiationState AS DWORD ' unsigned long
END TYPE
' // Size = 8 bytes
TYPE SecPkgContext_NegotiationInfoW DWORD
 PackageInfo AS SecPkgInfoW PTR ' PSecPkgInfoW
 NegotiationState AS DWORD ' unsigned long
END TYPE
MACRO SecPkgContext_NegotiationInfo = SecPkgContext_NegotiationInfoA
%EQUATE `SECPKG_NEGOTIATION_COMPLETE = 0
%EQUATE `SECPKG_NEGOTIATION_OPTIMISTIC = 1
%EQUATE `SECPKG_NEGOTIATION_IN_PROGRESS = 2
%EQUATE `SECPKG_NEGOTIATION_DIRECT = 3
%EQUATE `SECPKG_NEGOTIATION_TRY_MULTICRED = 4
' // Size = 8 bytes
TYPE SecPkgContext_NativeNamesW DWORD
 sClientName AS WSTRINGZ PTR ' SEC_WCHAR *
 sServerName AS WSTRINGZ PTR ' SEC_WCHAR *
END TYPE
' // Size = 8 bytes
TYPE SecPkgContext_NativeNamesA DWORD
 sClientName AS ASCIIZ PTR ' SEC_CHAR *
 sServerName AS ASCIIZ PTR ' SEC_CHAR *
END TYPE
MACRO SecPkgContext_NativeNames = SecPkgContext_NativeNamesA
'#if OSVER(NTDDI_VERSION) > NTDDI_WIN2K
' // Size = 8 bytes
TYPE SecPkgContext_CredentialNameW DWORD
 CredentialType AS DWORD ' unsigned long
 sCredentialName AS WSTRINGZ PTR ' SEC_WCHAR *
END TYPE
'#endif // Later than win2k
' // Size = 8 bytes
TYPE SecPkgContext_CredentialNameA DWORD
 CredentialType AS DWORD ' unsigned long
 sCredentialName AS ASCIIZ PTR ' SEC_CHAR *
END TYPE
MACRO SecPkgContext_CredentialName = SecPkgContext_CredentialNameA
' // Size = 4 bytes
TYPE SecPkgContext_AccessToken DWORD
 AccessToken AS DWORD ' void *
END TYPE
' // Size = 8 bytes
TYPE SecPkgContext_TargetInformation DWORD
 MarshalledTargetInfoLength AS DWORD ' unsigned long
 MarshalledTargetInfo AS BYTE PTR ' unsigned char *
END TYPE
' // Size = 8 bytes
TYPE SecPkgContext_AuthzID DWORD
 AuthzIDLength AS DWORD ' unsigned long
 AuthzID AS ASCIIZ PTR ' char *
END TYPE
' // Size = 8 bytes
TYPE SecPkgContext_Target DWORD
 TargetLength AS DWORD ' unsigned long
 Target AS ASCIIZ PTR ' char *
END TYPE
' // Size = 4 bytes
TYPE SecPkgContext_ClientSpecifiedTarget DWORD
 sTargetName AS WSTRINGZ PTR ' SEC_WCHAR *
END TYPE
' // Size = 8 bytes
TYPE SecPkgContext_Bindings DWORD
 BindingsLength AS DWORD ' unsigned long
 Bindings AS SEC_CHANNEL_BINDINGS PTR
END TYPE
'typedef void
'(SEC_ENTRY * SEC_GET_KEY_FN) (
' void * Arg, // Argument passed in
' void * Principal, // Principal ID
' unsigned long KeyVer, // Key Version
' void * * Key, // Returned ptr to key
' SECURITY_STATUS * Status // returned status
' );
'//
'// Flags for ExportSecurityContext
'//
%EQUATE `SECPKG_CONTEXT_EXPORT_RESET_NEW = &H00000001 ' // New context is reset to initial state
%EQUATE `SECPKG_CONTEXT_EXPORT_DELETE_OLD = &H00000002 ' // Old context is deleted during export
'// This is only valid in W2K3SP1 and greater
%EQUATE `SECPKG_CONTEXT_EXPORT_TO_KERNEL = &H00000004 ' // Context is to be transferred to the kernel
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION AcquireCredentialsHandleW LIB "Secur32.dll" ALIAS "AcquireCredentialsHandleW" ( pszPrincipal AS WSTRINGZ, ' Name of principal
 pszPackage AS WSTRINGZ, ' Name of package
 BYVAL fCredentialUse AS DWORD, ' Flags indicating use
 pvLogonId AS ANY, ' void ptr ' Pointer to logon ID
 pAuthData AS ANY, ' void ptr ' Package specific data
 BYVAL pGetKeyFn AS DWORD, ' SEC_GET_KEY_FN ' Pointer to GetKey() func
 pvGetKeyArgument AS ANY, ' void ptr ' Value to pass to GetKey()
 phCredential AS CredHandle, ' (out) Cred Handle
 ptsExpiry AS ANY ' (out) Lifetime (optional)
 ) AS LONG
#ELSE
DECLARE FUNCTION AcquireCredentialsHandleW LIB "secur32.dll" ALIAS "AcquireCredentialsHandleW" ( BYREF pszPrincipal AS WSTRINGZ , BYREF pszPackage AS WSTRINGZ , BYVAL fCredentialUse AS QUAD , BYREF pvLogonId AS ANY , BYREF pAuthData AS ANY , BYVAL pGetKeyFn AS QUAD , BYVAL pvGetKeyArgument AS QUAD , BYREF phCredential AS ANY , BYREF ptsExpiry AS ANY ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION AcquireCredentialsHandleA LIB "Secur32.dll" ALIAS "AcquireCredentialsHandleA" ( pszPrincipal AS ASCIIZ, ' Name of principal
 pszPackage AS ASCIIZ, ' Name of package
 BYVAL fCredentialUse AS DWORD, ' Flags indicating use
 pvLogonId AS ANY, ' void ptr ' Pointer to logon ID
 pAuthData AS ANY, ' void ptr ' Package specific data
 BYVAL pGetKeyFn AS DWORD, ' SEC_GET_KEY_FN ' Pointer to GetKey() func
 pvGetKeyArgument AS ANY, ' void ptr ' Value to pass to GetKey()
 phCredential AS CredHandle, ' (out) Cred Handle
 ptsExpiry AS ANY ' (out) Lifetime (optional)
 ) AS LONG
#ELSE
DECLARE FUNCTION AcquireCredentialsHandleA LIB "secur32.dll" ALIAS "AcquireCredentialsHandleA" ( BYREF pszPrincipal AS ASCIIZ , BYREF pszPackage AS ASCIIZ , BYVAL fCredentialUse AS QUAD , BYREF pvLogonId AS ANY , BYREF pAuthData AS ANY , BYVAL pGetKeyFn AS QUAD , BYVAL pvGetKeyArgument AS QUAD , BYREF phCredential AS ANY , BYREF ptsExpiry AS ANY ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%UNICODE)
 MACRO AcquireCredentialsHandle = AcquireCredentialsHandleW
#ELSE
 MACRO AcquireCredentialsHandle = AcquireCredentialsHandleA
#ENDIF
DECLARE FUNCTION FreeCredentialsHandle LIB "secur32.dll" ALIAS "FreeCredentialsHandle" ( BYREF phCredential AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION AddCredentialsW LIB "secur32.dll" ALIAS "AddCredentialsW" ( BYREF hCredentials AS ANY , BYREF pszPrincipal AS WSTRINGZ , BYREF pszPackage AS WSTRINGZ , BYVAL fCredentialUse AS QUAD , BYREF pAuthData AS ANY , BYVAL pGetKeyFn AS QUAD , BYVAL pvGetKeyArgument AS QUAD , BYREF ptsExpiry AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION AddCredentialsA LIB "secur32.dll" ALIAS "AddCredentialsA" ( BYREF hCredentials AS ANY , BYREF pszPrincipal AS ASCIIZ , BYREF pszPackage AS ASCIIZ , BYVAL fCredentialUse AS QUAD , BYREF pAuthData AS ANY , BYVAL pGetKeyFn AS QUAD , BYVAL pvGetKeyArgument AS QUAD , BYREF ptsExpiry AS ANY ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO AddCredentials = AddCredentialsW
#ELSE
 MACRO AddCredentials = AddCredentialsA
#ENDIF
'////////////////////////////////////////////////////////////////////////
'///
'/// Password Change Functions
'///
'////////////////////////////////////////////////////////////////////////
'#if ISSP_MODE != 0
DECLARE FUNCTION ChangeAccountPasswordW LIB "secur32.dll" ALIAS "ChangeAccountPasswordW" ( BYREF pszPackageName AS WSTRINGZ , BYREF pszDomainName AS WSTRINGZ , BYREF pszAccountName AS WSTRINGZ , BYREF pszOldPassword AS WSTRINGZ , BYREF pszNewPassword AS WSTRINGZ , BYVAL bImpersonating AS BYTE , BYVAL dwReserved AS QUAD , BYREF pOutput AS SecBufferDesc ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION ChangeAccountPasswordA LIB "secur32.dll" ALIAS "ChangeAccountPasswordA" ( BYREF pszPackageName AS ASCIIZ , BYREF pszDomainName AS ASCIIZ , BYREF pszAccountName AS ASCIIZ , BYREF pszOldPassword AS ASCIIZ , BYREF pszNewPassword AS ASCIIZ , BYVAL bImpersonating AS BYTE , BYVAL dwReserved AS QUAD , BYREF pOutput AS SecBufferDesc ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO ChangeAccountPassword = ChangeAccountPasswordW
#ELSE
 MACRO ChangeAccountPassword = ChangeAccountPasswordA
#ENDIF
'#endif // ISSP_MODE
'////////////////////////////////////////////////////////////////////////
'///
'/// Context Management Functions
'///
'////////////////////////////////////////////////////////////////////////
DECLARE FUNCTION InitializeSecurityContextW LIB "secur32.dll" ALIAS "InitializeSecurityContextW" ( BYREF phCredential AS ANY , BYREF phContext AS ANY , BYREF pszTargetName AS WSTRINGZ , BYVAL fContextReq AS QUAD , BYVAL Reserved1 AS QUAD , BYVAL TargetDataRep AS LONG , BYREF pInput AS SecBufferDesc , BYVAL Reserved2 AS QUAD , BYREF phNewContext AS ANY , BYREF pOutput AS SecBufferDesc , BYREF pfContextAttr AS QUAD , BYREF ptsExpiry AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION InitializeSecurityContextA LIB "secur32.dll" ALIAS "InitializeSecurityContextA" ( BYREF phCredential AS ANY , BYREF phContext AS ANY , BYREF pszTargetName AS ASCIIZ , BYVAL fContextReq AS QUAD , BYVAL Reserved1 AS QUAD , BYVAL TargetDataRep AS LONG , BYREF pInput AS SecBufferDesc , BYVAL Reserved2 AS QUAD , BYREF phNewContext AS ANY , BYREF pOutput AS SecBufferDesc , BYREF pfContextAttr AS QUAD , BYREF ptsExpiry AS ANY ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO InitializeSecurityContext = InitializeSecurityContextW
#ELSE
 MACRO InitializeSecurityContext = InitializeSecurityContextA
#ENDIF
DECLARE FUNCTION AcceptSecurityContext LIB "secur32.dll" ALIAS "AcceptSecurityContext" ( BYREF phCredential AS ANY , BYREF phContext AS ANY , BYREF pInput AS SecBufferDesc , BYVAL fContextReq AS QUAD , BYVAL TargetDataRep AS QUAD , BYREF phNewContext AS ANY , BYREF pOutput AS SecBufferDesc , BYREF pfContextAttr AS QUAD , BYREF ptsExpiry AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION CompleteAuthToken LIB "secur32.dll" ALIAS "CompleteAuthToken" ( BYREF phContext AS ANY , BYREF pToken AS SecBufferDesc ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION ImpersonateSecurityContext LIB "secur32.dll" ALIAS "ImpersonateSecurityContext" ( BYREF phContext AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION RevertSecurityContext LIB "secur32.dll" ALIAS "RevertSecurityContext" ( BYREF phContext AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION QuerySecurityContextToken LIB "secur32.dll" ALIAS "QuerySecurityContextToken" ( BYREF phContext AS ANY , BYREF Token AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION DeleteSecurityContext LIB "secur32.dll" ALIAS "DeleteSecurityContext" ( BYREF phContext AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION ApplyControlToken LIB "secur32.dll" ALIAS "ApplyControlToken" ( BYREF phContext AS ANY , BYREF pInput AS SecBufferDesc ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION QueryContextAttributesW LIB "secur32.dll" ALIAS "QueryContextAttributesW" ( BYREF phContext AS ANY , BYVAL ulAttribute AS QUAD , BYREF pBuffer AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION QueryContextAttributesA LIB "secur32.dll" ALIAS "QueryContextAttributesA" ( BYREF phContext AS ANY , BYVAL ulAttribute AS QUAD , BYREF pBuffer AS ANY ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO QueryContextAttributes = QueryContextAttributesW
#ELSE
 MACRO QueryContextAttributes = QueryContextAttributesA
#ENDIF
DECLARE FUNCTION SetContextAttributesW LIB "secur32.dll" ALIAS "SetContextAttributesW" ( BYREF phContext AS ANY , BYVAL ulAttribute AS QUAD , BYREF pBuffer AS ANY , BYVAL cbBuffer AS QUAD ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION SetContextAttributesA LIB "secur32.dll" ALIAS "SetContextAttributesA" ( BYREF phContext AS ANY , BYVAL ulAttribute AS QUAD , BYREF pBuffer AS ANY , BYVAL cbBuffer AS QUAD ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO SetContextAttributes = SetContextAttributesW
#ELSE
 MACRO SetContextAttributes = SetContextAttributesA
#ENDIF
DECLARE FUNCTION QueryCredentialsAttributesW LIB "secur32.dll" ALIAS "QueryCredentialsAttributesW" ( BYREF phCredential AS ANY , BYVAL ulAttribute AS QUAD , BYREF pBuffer AS ANY ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION QueryCredentialsAttributesA LIB "secur32.dll" ALIAS "QueryCredentialsAttributesA" ( BYREF phCredential AS ANY , BYVAL ulAttribute AS QUAD , BYREF pBuffer AS ANY ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO QueryCredentialsAttributes = QueryCredentialsAttributesW
#ELSE
 MACRO QueryCredentialsAttributes = QueryCredentialsAttributesA
#ENDIF
DECLARE FUNCTION SetCredentialsAttributesW LIB "secur32.dll" ALIAS "SetCredentialsAttributesW" ( BYREF phCredential AS ANY , BYVAL ulAttribute AS QUAD , BYREF pBuffer AS ANY , BYVAL cbBuffer AS QUAD ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION SetCredentialsAttributesA LIB "secur32.dll" ALIAS "SetCredentialsAttributesA" ( BYREF phCredential AS ANY , BYVAL ulAttribute AS QUAD , BYREF pBuffer AS ANY , BYVAL cbBuffer AS QUAD ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO SetCredentialsAttributes = SetCredentialsAttributesW
#ELSE
 MACRO SetCredentialsAttributes = SetCredentialsAttributesA
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION FreeContextBuffer LIB "Secur32.dll" ALIAS "FreeContextBuffer" ( pvContextBuffer AS ANY ) AS LONG ' void ptr ' buffer to free
#ELSE
DECLARE FUNCTION FreeContextBuffer LIB "secur32.dll" ALIAS "FreeContextBuffer" ( BYVAL pvContextBuffer AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
'///////////////////////////////////////////////////////////////////
'////
'//// Message Support API
'////
'//////////////////////////////////////////////////////////////////
DECLARE FUNCTION MakeSignature LIB "secur32.dll" ALIAS "MakeSignature" ( BYREF phContext AS ANY , BYVAL fQOP AS QUAD , BYREF pMessage AS SecBufferDesc , BYVAL MessageSeqNo AS QUAD ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION VerifySignature LIB "secur32.dll" ALIAS "VerifySignature" ( BYREF phContext AS ANY , BYREF pMessage AS SecBufferDesc , BYVAL MessageSeqNo AS QUAD , BYREF pfQOP AS QUAD ) AS LONG ' SECURITY_STATUS
%EQUATE `SECQOP_WRAP_NO_ENCRYPT = &H80000001
%EQUATE `SECQOP_WRAP_OOB_DATA = &H40000000
DECLARE FUNCTION EncryptMessage LIB "secur32.dll" ALIAS "EncryptMessage" ( BYREF phContext AS ANY , BYVAL fQOP AS QUAD , BYREF pMessage AS SecBufferDesc , BYVAL MessageSeqNo AS QUAD ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION DecryptMessage LIB "secur32.dll" ALIAS "DecryptMessage" ( BYREF phContext AS ANY , BYREF pMessage AS SecBufferDesc , BYVAL MessageSeqNo AS QUAD , BYREF fQOP AS QUAD ) AS LONG ' SECURITY_STATUS
'///////////////////////////////////////////////////////////////////////////
'////
'//// Misc.
'////
'///////////////////////////////////////////////////////////////////////////
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION EnumerateSecurityPackagesW LIB "Secur32.dll" ALIAS "EnumerateSecurityPackagesW" ( BYVAL pcPackages AS QUAD PTR, ' Receives num. packages
 BYVAL ppPackageInfo AS DWORD ' SecPkgInfoW PTR PTR ' Receives array of info
 ) AS LONG
#ELSE
DECLARE FUNCTION EnumerateSecurityPackagesW LIB "secur32.dll" ALIAS "EnumerateSecurityPackagesW" ( BYREF pcPackages AS QUAD , BYREF ppPackageInfo AS ANY ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION EnumerateSecurityPackagesA LIB "Secur32.dll" ALIAS "EnumerateSecurityPackagesA" ( BYVAL pcPackages AS QUAD PTR, ' Receives num. packages
 BYVAL ppPackageInfo AS DWORD ' SecPkgInfoA PTR PTR ' Receives array of info
 ) AS LONG
#ELSE
DECLARE FUNCTION EnumerateSecurityPackagesA LIB "secur32.dll" ALIAS "EnumerateSecurityPackagesA" ( BYREF pcPackages AS QUAD , BYREF ppPackageInfo AS ANY ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%UNICODE)
 MACRO EnumerateSecurityPackages = EnumerateSecurityPackagesW
#ELSE
 MACRO EnumerateSecurityPackages = EnumerateSecurityPackagesA
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION QuerySecurityPackageInfoW LIB "Secur32.dll" ALIAS "QuerySecurityPackageInfoW" ( pszPackageName AS WSTRINGZ, ' Name of package
 BYVAL ppPackageInfo AS DWORD ' SecPkgInfoW PTR PTR ' Receives package info
 ) AS LONG
#ELSE
DECLARE FUNCTION QuerySecurityPackageInfoW LIB "secur32.dll" ALIAS "QuerySecurityPackageInfoW" ( BYREF pszPackageName AS WSTRINGZ , BYREF ppPackageInfo AS ANY ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION QuerySecurityPackageInfoA LIB "Secur32.dll" ALIAS "QuerySecurityPackageInfoA" ( pszPackageName AS ASCIIZ, ' Name of package
 BYVAL ppPackageInfo AS DWORD ' SecPkgInfoA PTR PTR ' Receives package info
 ) AS LONG
#ELSE
DECLARE FUNCTION QuerySecurityPackageInfoA LIB "secur32.dll" ALIAS "QuerySecurityPackageInfoA" ( BYREF pszPackageName AS ASCIIZ , BYREF ppPackageInfo AS ANY ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%UNICODE)
 MACRO QuerySecurityPackageInfo = QuerySecurityPackageInfoW
#ELSE
 MACRO QuerySecurityPackageInfo = QuerySecurityPackageInfoA
#ENDIF
' SecDelegationType enum
%EQUATE `SecFull = 0
%EQUATE `SecService = 1
%EQUATE `SecTree = 2
%EQUATE `SecDirectory = 3
%EQUATE `SecObject = 4
DECLARE FUNCTION DelegateSecurityContext LIB "secur32.dll" ALIAS "DelegateSecurityContext" ( BYREF phContext AS ANY , BYREF pszTarget AS ASCIIZ , BYVAL DelegationType AS LONG , BYREF pExpiry AS ANY , BYREF pPackageParameters AS SecBuffer , BYREF pOutput AS SecBufferDesc ) AS LONG ' SECURITY_STATUS
'///////////////////////////////////////////////////////////////////////////
'////
'//// Proxies
'////
'///////////////////////////////////////////////////////////////////////////
'//
'// Proxies are only available on NT platforms
'//
'///////////////////////////////////////////////////////////////////////////
'////
'//// Context export/import
'////
'///////////////////////////////////////////////////////////////////////////
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION ExportSecurityContext LIB "Secur32.dll" ALIAS "ExportSecurityContext" ( phContext AS ANY, ' (in) context to export
 BYVAL fFlags AS DWORD, ' (in) option flags
 pPackedContext AS SecBuffer, ' (out) marshalled context
 pToken AS ANY ' void ptr ptr ' (out, optional) token handle for impersonation
 ) AS LONG
#ELSE
DECLARE FUNCTION ExportSecurityContext LIB "secur32.dll" ALIAS "ExportSecurityContext" ( BYREF phContext AS ANY , BYVAL fFlags AS QUAD , BYREF pPackedContext AS SecBuffer , BYREF pToken AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION ImportSecurityContextW LIB "Secur32.dll" ALIAS "ImportSecurityContextW" ( pszPackage AS WSTRINGZ, pPackedContext AS SecBuffer, ' (in) marshalled context
 Token AS ANY, ' void *, ' (in, optional) handle to token for context
 phContext AS ANY ' (out) new context handle
 ) AS LONG
#ELSE
DECLARE FUNCTION ImportSecurityContextW LIB "secur32.dll" ALIAS "ImportSecurityContextW" ( BYREF pszPackage AS WSTRINGZ , BYREF pPackedContext AS SecBuffer , BYVAL Token AS QUAD , BYREF phContext AS ANY ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION ImportSecurityContextA LIB "Secur32.dll" ALIAS "ImportSecurityContextA" ( pszPackage AS ASCIIZ, pPackedContext AS SecBuffer, ' (in) marshalled context
 Token AS ANY, ' void ptr ' (in, optional) handle to token for context
 phContext AS ANY ' (out) new context handle
 ) AS LONG
#ELSE
DECLARE FUNCTION ImportSecurityContextA LIB "secur32.dll" ALIAS "ImportSecurityContextA" ( BYREF pszPackage AS ASCIIZ , BYREF pPackedContext AS SecBuffer , BYVAL Token AS QUAD , BYREF phContext AS ANY ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%UNICODE)
 MACRO ImportSecurityContext = ImportSecurityContextW
#ELSE
 MACRO ImportSecurityContext = ImportSecurityContextA
#ENDIF
'#IF %ISSP_MODE = 0
'KSECDDDECLSPEC
'NTSTATUS
'NTAPI
'SecMakeSPN(
' IN PUNICODE_STRING ServiceClass,
' IN PUNICODE_STRING ServiceName,
' IN PUNICODE_STRING InstanceName OPTIONAL,
' IN USHORT InstancePort OPTIONAL,
' IN PUNICODE_STRING Referrer OPTIONAL,
' IN OUT PUNICODE_STRING Spn,
' OUT PULONG Length OPTIONAL,
' IN BOOLEAN Allocate
' );
'#if OSVER(NTDDI_VERSION) > NTDD_WIN2K
'KSECDDDECLSPEC
'NTSTATUS
'NTAPI
'SecMakeSPNEx(
' IN PUNICODE_STRING ServiceClass,
' IN PUNICODE_STRING ServiceName,
' IN PUNICODE_STRING InstanceName OPTIONAL,
' IN USHORT InstancePort OPTIONAL,
' IN PUNICODE_STRING Referrer OPTIONAL,
' IN PUNICODE_STRING TargetInfo OPTIONAL,
' IN OUT PUNICODE_STRING Spn,
' OUT PULONG Length OPTIONAL,
' IN BOOLEAN Allocate
' );
'#if OSVER(NTDDI_VERSION) > NTDDI_WS03
'KSECDDDECLSPEC
'NTSTATUS
'NTAPI
'SecMakeSPNEx2(
' IN PUNICODE_STRING ServiceClass,
' IN PUNICODE_STRING ServiceName,
' IN PUNICODE_STRING InstanceName OPTIONAL,
' IN USHORT InstancePort OPTIONAL,
' IN PUNICODE_STRING Referrer OPTIONAL,
' IN PUNICODE_STRING InTargetInfo OPTIONAL,
' IN OUT PUNICODE_STRING Spn,
' OUT PULONG TotalSize OPTIONAL,
' IN BOOLEAN Allocate,
' IN BOOLEAN IsTargetInfoMarshaled
' );
'#endif // Windows Vista and greater
'KSECDDDECLSPEC
'NTSTATUS
'SEC_ENTRY
'SecLookupAccountSid(
' IN PSID Sid,
' IN OUT PULONG NameSize,
' OUT PUNICODE_STRING NameBuffer,
' IN OUT PULONG DomainSize OPTIONAL,
' OUT PUNICODE_STRING DomainBuffer OPTIONAL,
' OUT PSID_NAME_USE NameUse
' );
'KSECDDDECLSPEC
'NTSTATUS
'SEC_ENTRY
'SecLookupAccountName(
' IN PUNICODE_STRING Name,
' IN OUT PULONG SidSize,
' OUT PSID Sid,
' OUT PSID_NAME_USE NameUse,
' IN OUT PULONG DomainSize OPTIONAL,
' OUT PUNICODE_STRING ReferencedDomain OPTIONAL
' );
'#endif // Greater than W2k
'#if OSVER(NTDDI_VERSION) > NTDDI_WINXP
'KSECDDDECLSPEC
'NTSTATUS
'SEC_ENTRY
'SecLookupWellKnownSid(
' IN WELL_KNOWN_SID_TYPE SidType,
' OUT PSID Sid,
' ULONG SidBufferSize,
' OUT PULONG SidSize OPTIONAL
' );
'#endif // Greater than XP
'#ENDIF
'///////////////////////////////////////////////////////////////////////////////
'////
'//// Fast access for RPC:
'////
'///////////////////////////////////////////////////////////////////////////////
$SECURITY_ENTRYPOINT_ANSIW = "InitSecurityInterfaceW"
$SECURITY_ENTRYPOINT_ANSIA = "InitSecurityInterfaceA"
$$SECURITY_ENTRYPOINTW = "InitSecurityInterfaceW"$$ ' // ntifs
$$SECURITY_ENTRYPOINTA = "InitSecurityInterfaceA"$$
$SECURITY_ENTRYPOINT16 = "INITSECURITYINTERFACEA"
'#define FreeCredentialHandle FreeCredentialsHandle
' // Size = 116 bytes
TYPE SecurityFunctionTableW DWORD
 dwVersion AS DWORD ' unsigned long
 EnumerateSecurityPackagesW AS DWORD ' ENUMERATE_SECURITY_PACKAGES_FN_W
 QueryCredentialsAttributesW AS DWORD ' QUERY_CREDENTIALS_ATTRIBUTES_FN_W
 AcquireCredentialsHandleW AS DWORD ' ACQUIRE_CREDENTIALS_HANDLE_FN_W
 FreeCredentialsHandle AS DWORD ' FREE_CREDENTIALS_HANDLE_FN
 Reserved2 AS DWORD ' void *
 InitializeSecurityContextW AS DWORD ' INITIALIZE_SECURITY_CONTEXT_FN_W
 AcceptSecurityContext AS DWORD ' ACCEPT_SECURITY_CONTEXT_FN
 CompleteAuthToken AS DWORD ' COMPLETE_AUTH_TOKEN_FN
 DeleteSecurityContext AS DWORD ' DELETE_SECURITY_CONTEXT_FN
 ApplyControlToken AS DWORD ' APPLY_CONTROL_TOKEN_FN
 QueryContextAttributesW AS DWORD ' QUERY_CONTEXT_ATTRIBUTES_FN_W
 ImpersonateSecurityContext AS DWORD ' IMPERSONATE_SECURITY_CONTEXT_FN
 RevertSecurityContext AS DWORD ' REVERT_SECURITY_CONTEXT_FN
 MakeSignature AS DWORD ' MAKE_SIGNATURE_FN
 VerifySignature AS DWORD ' VERIFY_SIGNATURE_FN
 FreeContextBuffer AS DWORD ' FREE_CONTEXT_BUFFER_FN
 QuerySecurityPackageInfoW AS DWORD ' QUERY_SECURITY_PACKAGE_INFO_FN_W
 Reserved3 AS DWORD ' void *
 Reserved4 AS DWORD ' void *
 ExportSecurityContext AS DWORD ' EXPORT_SECURITY_CONTEXT_FN
 ImportSecurityContextW AS DWORD ' IMPORT_SECURITY_CONTEXT_FN_W
 AddCredentialsW AS DWORD ' ADD_CREDENTIALS_FN_W
 Reserved8 AS DWORD ' void *
 QuerySecurityContextToken AS DWORD ' QUERY_SECURITY_CONTEXT_TOKEN_FN
 EncryptMessage AS DWORD ' ENCRYPT_MESSAGE_FN
 DecryptMessage AS DWORD ' DECRYPT_MESSAGE_FN
'#if OSVER(NTDDI_VERSION) > NTDDI_WIN2K
 ' // Fields below this are available in OSes after w2k
 SetContextAttributesW AS DWORD ' SET_CONTEXT_ATTRIBUTES_FN_W
'#endif // greater thean 2K
'#if NTDDI_VERSION > NTDDI_WS03SP1
 ' // Fields below this are available in OSes after W2k3SP1
 SetCredentialsAttributesW AS DWORD ' SET_CREDENTIALS_ATTRIBUTES_FN_W
'#endif
'#if ISSP_MODE != 0
' CHANGE_PASSWORD_FN_W ChangeAccountPasswordW;
'#else
' void * Reserved9;
'#endif
END TYPE
' // Size = 116 bytes
TYPE SecurityFunctionTableA DWORD
 dwVersion AS DWORD ' unsigned long
 EnumerateSecurityPackagesA AS DWORD ' ENUMERATE_SECURITY_PACKAGES_FN_A
 QueryCredentialsAttributesA AS DWORD ' QUERY_CREDENTIALS_ATTRIBUTES_FN_A
 AcquireCredentialsHandleA AS DWORD ' ACQUIRE_CREDENTIALS_HANDLE_FN_A
 FreeCredentialHandle AS DWORD ' FREE_CREDENTIALS_HANDLE_FN
 Reserved2 AS DWORD ' void *
 InitializeSecurityContextA AS DWORD ' INITIALIZE_SECURITY_CONTEXT_FN_A
 AcceptSecurityContext AS DWORD ' ACCEPT_SECURITY_CONTEXT_FN
 CompleteAuthToken AS DWORD ' COMPLETE_AUTH_TOKEN_FN
 DeleteSecurityContext AS DWORD ' DELETE_SECURITY_CONTEXT_FN
 ApplyControlToken AS DWORD ' APPLY_CONTROL_TOKEN_FN
 QueryContextAttributesA AS DWORD ' QUERY_CONTEXT_ATTRIBUTES_FN_A
 ImpersonateSecurityContext AS DWORD ' IMPERSONATE_SECURITY_CONTEXT_FN
 RevertSecurityContext AS DWORD ' REVERT_SECURITY_CONTEXT_FN
 MakeSignature AS DWORD ' MAKE_SIGNATURE_FN
 VerifySignature AS DWORD ' VERIFY_SIGNATURE_FN
 FreeContextBuffer AS DWORD ' FREE_CONTEXT_BUFFER_FN
 QuerySecurityPackageInfoA AS DWORD ' QUERY_SECURITY_PACKAGE_INFO_FN_A
 Reserved3 AS DWORD ' void *
 Reserved4 AS DWORD ' void *
 ExportSecurityContext AS DWORD ' EXPORT_SECURITY_CONTEXT_FN
 ImportSecurityContextA AS DWORD ' IMPORT_SECURITY_CONTEXT_FN_A
 AddCredentialsA AS DWORD ' ADD_CREDENTIALS_FN_A
 Reserved8 AS DWORD ' void *
 QuerySecurityContextToken AS DWORD ' QUERY_SECURITY_CONTEXT_TOKEN_FN
 EncryptMessage AS DWORD ' ENCRYPT_MESSAGE_FN
 DecryptMessage AS DWORD ' DECRYPT_MESSAGE_FN
 SetContextAttributesA AS DWORD ' SET_CONTEXT_ATTRIBUTES_FN_A
 SetCredentialsAttributesA AS DWORD ' SET_CREDENTIALS_ATTRIBUTES_FN_A
'#if ISSP_MODE != 0
' CHANGE_PASSWORD_FN_A ChangeAccountPasswordA;
'#else
' void * Reserved9;
'#endif
END TYPE
#IF %DEF(%UNICODE)
 MACRO SecurityFunctionTable = SecurityFunctionTableW
#ELSE
 MACRO SecurityFunctionTable = SecurityFunctionTableA
#ENDIF
'// Function table has all routines through DecryptMessage
%EQUATE `SECURITY_SUPPORT_PROVIDER_INTERFACE_VERSION = 1 ' // ntifs
'// Function table has all routines through SetContextAttributes
%EQUATE `SECURITY_SUPPORT_PROVIDER_INTERFACE_VERSION_2 = 2 ' // ntifs
'// Function table has all routines through SetCredentialsAttributes
%EQUATE `SECURITY_SUPPORT_PROVIDER_INTERFACE_VERSION_3 = 3 ' // ntifs
'// Function table has all routines through ChangeAccountPassword
%EQUATE `SECURITY_SUPPORT_PROVIDER_INTERFACE_VERSION_4 = 4 ' // ntifs
DECLARE FUNCTION InitSecurityInterfaceA LIB "secur32.dll" ALIAS "InitSecurityInterfaceA" ( ) AS QUAD ' PSecurityFunctionTableA
DECLARE FUNCTION InitSecurityInterfaceW LIB "secur32.dll" ALIAS "InitSecurityInterfaceW" ( ) AS QUAD ' PSecurityFunctionTableW
#IF %DEF(%UNICODE)
 MACRO InitSecurityInterface = InitSecurityInterfaceW
#ELSE
 MACRO InitSecurityInterface = InitSecurityInterfaceA
#ENDIF
'#IF %DEF(%SECURITY_WIN32)
'//
'// SASL Profile Support
'//
DECLARE FUNCTION SaslEnumerateProfilesA LIB "secur32.dll" ALIAS "SaslEnumerateProfilesA" ( BYREF ProfileList AS QUAD , BYREF ProfileCount AS QUAD ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION SaslEnumerateProfilesW LIB "secur32.dll" ALIAS "SaslEnumerateProfilesW" ( BYREF ProfileList AS QUAD , BYREF ProfileCount AS QUAD ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO SaslEnumerateProfiles = SaslEnumerateProfilesW
#ELSE
 MACRO SaslEnumerateProfiles = SaslEnumerateProfilesA
#ENDIF
DECLARE FUNCTION SaslGetProfilePackageA LIB "secur32.dll" ALIAS "SaslGetProfilePackageA" ( BYREF ProfileName AS ASCIIZ , BYREF PackageInfo AS SecPkgInfoA ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION SaslGetProfilePackageW LIB "secur32.dll" ALIAS "SaslGetProfilePackageW" ( BYREF ProfileName AS WSTRINGZ , BYREF PackageInfo AS SecPkgInfoW ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO SaslGetProfilePackage = SaslGetProfilePackageW
#ELSE
 MACRO SaslGetProfilePackage = SaslGetProfilePackageA
#ENDIF
DECLARE FUNCTION SaslIdentifyPackageA LIB "secur32.dll" ALIAS "SaslIdentifyPackageA" ( BYREF pInput AS SecBufferDesc , BYREF PackageInfo AS SecPkgInfoA ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION SaslIdentifyPackageW LIB "secur32.dll" ALIAS "SaslIdentifyPackageW" ( BYREF pInput AS SecBufferDesc , BYREF PackageInfo AS SecPkgInfoW ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO SaslIdentifyPackage = SaslIdentifyPackageW
#ELSE
 MACRO SaslIdentifyPackage = SaslIdentifyPackageA
#ENDIF
DECLARE FUNCTION SaslInitializeSecurityContextW LIB "secur32.dll" ALIAS "SaslInitializeSecurityContextW" ( BYREF phCredential AS CredHandle , BYREF phContext AS CtxtHandle , BYREF pszTargetName AS WSTRINGZ , BYVAL fContextReq AS QUAD , BYVAL Reserved1 AS QUAD , BYVAL TargetDataRep AS QUAD , BYREF pInput AS SecBufferDesc , BYVAL Reserved2 AS QUAD , BYREF phNewContext AS CtxtHandle , BYREF pOutput AS SecBufferDesc , BYREF pfContextAttr AS QUAD , BYREF ptsExpiry AS QUAD ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION SaslInitializeSecurityContextA LIB "secur32.dll" ALIAS "SaslInitializeSecurityContextA" ( BYREF phCredential AS CredHandle , BYREF phContext AS CtxtHandle , BYREF pszTargetName AS ASCIIZ , BYVAL fContextReq AS QUAD , BYVAL Reserved1 AS QUAD , BYVAL TargetDataRep AS QUAD , BYREF pInput AS SecBufferDesc , BYVAL Reserved2 AS QUAD , BYREF phNewContext AS CtxtHandle , BYREF pOutput AS SecBufferDesc , BYREF pfContextAttr AS QUAD , BYREF ptsExpiry AS QUAD ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO SaslInitializeSecurityContext = SaslInitializeSecurityContextW
#ELSE
 MACRO SaslInitializeSecurityContext = SaslInitializeSecurityContextA
#ENDIF
DECLARE FUNCTION SaslAcceptSecurityContext LIB "secur32.dll" ALIAS "SaslAcceptSecurityContext" ( BYREF phCredential AS CredHandle , BYREF phContext AS CtxtHandle , BYREF pInput AS SecBufferDesc , BYVAL fContextReq AS QUAD , BYVAL TargetDataRep AS QUAD , BYREF phNewContext AS CtxtHandle , BYREF pOutput AS SecBufferDesc , BYREF pfContextAttr AS QUAD , BYREF ptsExpiry AS QUAD ) AS LONG ' SECURITY_STATUS
%EQUATE `SASL_OPTION_SEND_SIZE = 1 ' // Maximum size to send to peer
%EQUATE `SASL_OPTION_RECV_SIZE = 2 ' // Maximum size willing to receive
%EQUATE `SASL_OPTION_AUTHZ_STRING = 3 ' // Authorization string
%EQUATE `SASL_OPTION_AUTHZ_PROCESSING = 4 ' // Authorization string processing
' SASL_AUTHZID_STATE enum
%EQUATE `Sasl_AuthZIDForbidden = 0 ' // allow no AuthZID strings to be specified - error out (default)
%EQUATE `Sasl_AuthZIDProcessed = 1 ' // AuthZID Strings processed by Application or SSP
DECLARE FUNCTION SaslSetContextOption LIB "secur32.dll" ALIAS "SaslSetContextOption" ( BYREF ContextHandle AS CtxtHandle , BYVAL Option AS QUAD , BYVAL Value AS QUAD , BYVAL Size AS QUAD ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION SaslGetContextOption LIB "secur32.dll" ALIAS "SaslGetContextOption" ( BYREF ContextHandle AS CtxtHandle , BYVAL Option AS QUAD , BYVAL Value AS QUAD , BYVAL Size AS QUAD , BYREF Needed AS QUAD ) AS LONG ' SECURITY_STATUS
'#ENDIF ' #IF %DEF(%SECURITY_WIN32)
'//
'// This is the legacy credentials structure.
'// The EX version below is preferred.
#IF NOT %DEF(%AUTH_IDENTITY_DEFINED)
%EQUATE `AUTH_IDENTITY_DEFINED = 1
%EQUATE `SEC_WINNT_AUTH_IDENTITY_ANSI = &H1
%EQUATE `SEC_WINNT_AUTH_IDENTITY_UNICODE = &H2
' // Size = 28 bytes
TYPE SEC_WINNT_AUTH_IDENTITY_W DWORD
 User AS WORD PTR ' unsigned short * // Non-NULL terminated string.
 UserLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Domain AS WORD PTR ' unsigned short * // Non-NULL terminated string.
 DomainLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Password AS WORD PTR ' unsigned short * // Non-NULL terminated string.
 PasswordLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Flags AS DWORD ' unsigned long
END TYPE
' // Size = 28 bytes
TYPE SEC_WINNT_AUTH_IDENTITY_A DWORD
 User AS BYTE PTR ' unsigned char * // Non-NULL terminated string.
 UserLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Domain AS BYTE PTR ' unsigned char * // Non-NULL terminated string.
 DomainLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Password AS BYTE PTR ' unsigned char * // Non-NULL terminated string.
 PasswordLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Flags AS DWORD ' unsigned long
END TYPE
#IF %DEF(%UNICODE)
 MACRO SEC_WINNT_AUTH_IDENTITY = SEC_WINNT_AUTH_IDENTITY_W
#ELSE
 MACRO SEC_WINNT_AUTH_IDENTITY = SEC_WINNT_AUTH_IDENTITY_A
#ENDIF
#ENDIF ' //_AUTH_IDENTITY_DEFINED
#IF NOT %DEF(%AUTH_IDENTITY_EX2_DEFINED)
 %AUTH_IDENTITY_EX2_DEFINED = 1
%EQUATE `SEC_WINNT_AUTH_IDENTITY_VERSION_2 = &H201
' // Size = 48 bytes
TYPE SEC_WINNT_AUTH_IDENTITY_EX2 DWORD
 Version AS DWORD ' unsigned long // contains SEC_WINNT_AUTH_IDENTITY_VERSION_2
 cbHeaderLength AS WORD ' unsigned short
 cbStructureLength AS DWORD ' unsigned long
 UserOffset AS DWORD ' unsigned long // Non-NULL terminated string, unicode only
 UserLength AS WORD ' unsigned short // # of bytes (NOT WCHARs), not including NULL.
 DomainOffset AS DWORD ' unsigned long // Non-NULL terminated string, unicode only
 DomainLength AS WORD ' unsigned short // # of bytes (NOT WCHARs), not including NULL.
 PackedCredentialsOffset AS DWORD ' unsigned long // Non-NULL terminated string, unicode only
 PackedCredentialsLength AS WORD ' unsigned short // # of bytes (NOT WCHARs), not including NULL.
 Flags AS DWORD ' unsigned long
 PackageListOffset AS DWORD ' unsigned long // Non-NULL terminated string, unicode only
 PackageListLength AS WORD ' unsigned short
END TYPE
#ENDIF ' // _AUTH_IDENTITY_EX2_DEFINED
'//
'// This is the combined authentication identity structure that may be
'// used with the negotiate package, NTLM, Kerberos, or SCHANNEL
'//
#IF NOT %DEF(%SEC_WINNT_AUTH_IDENTITY_VERSION)
%EQUATE `SEC_WINNT_AUTH_IDENTITY_VERSION = &H200
' // Size = 44 bytes
TYPE SEC_WINNT_AUTH_IDENTITY_EXW DWORD
 Version AS DWORD ' unsigned long
 Length AS DWORD ' unsigned long
 User AS WORD PTR ' unsigned short * // Non-NULL terminated string.
 UserLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Domain AS WORD PTR ' unsigned short * // Non-NULL terminated string.
 DomainLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Password AS WORD PTR ' unsigned short * // Non-NULL terminated string.
 PasswordLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Flags AS DWORD ' unsigned long
 PackageList AS WORD PTR ' unsigned short *
 PackageListLength AS DWORD ' unsigned long
END TYPE
' // Size = 44 bytes
TYPE SEC_WINNT_AUTH_IDENTITY_EXA DWORD
 Version AS DWORD ' unsigned long
 Length AS DWORD ' unsigned long
 User AS BYTE PTR ' unsigned char * // Non-NULL terminated string.
 UserLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Domain AS BYTE PTR ' unsigned char * // Non-NULL terminated string.
 DomainLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Password AS BYTE PTR ' unsigned char * // Non-NULL terminated string.
 PasswordLength AS DWORD ' unsigned long // # of characters (NOT bytes), not including NULL.
 Flags AS DWORD ' unsigned long
 PackageList AS BYTE PTR ' unsigned char *
 PackageListLength AS DWORD ' unsigned long
END TYPE
#IF %DEF(%UNICODE)
 MACRO SEC_WINNT_AUTH_IDENTITY_EX = SEC_WINNT_AUTH_IDENTITY_EXW
#ELSE
 MACRO SEC_WINNT_AUTH_IDENTITY_EX = SEC_WINNT_AUTH_IDENTITY_EXA
#ENDIF
#ENDIF ' // SEC_WINNT_AUTH_IDENTITY_VERSION
#IF NOT %DEF(%AUTH_IDENTITY_INFO_DEFINED)
 %AUTH_IDENTITY_INFO_DEFINED = 1
'//
'// the procedure for how to parse a SEC_WINNT_AUTH_IDENTITY_INFO structure:
'//
'// 1) First check the first DWORD of SEC_WINNT_AUTH_IDENTITY_INFO, if the first
'// DWORD is 0x200, it is either an AuthIdExw or AuthIdExA, otherwise if the first
'// DWORD is 0x201, the structure is an AuthIdEx2 structure. Otherwise the structure
'// is either an AuthId_a or an AuthId_w.
'//
'// 2) Secondly check the flags for SEC_WINNT_AUTH_IDENTITY_ANSI or
'// SEC_WINNT_AUTH_IDENTITY_UNICODE, the presence of the former means the structure
'// is an ANSI structure. Otherwise, the structure is the wide version. Note that
'// AuthIdEx2 does not have an ANSI version so this check does not apply to it.
'//
' // Size = 48 bytes
UNION SEC_WINNT_AUTH_IDENTITY_INFO
 AuthIdExw AS SEC_WINNT_AUTH_IDENTITY_EXW
 AuthIdExa AS SEC_WINNT_AUTH_IDENTITY_EXA
 AuthId_a AS SEC_WINNT_AUTH_IDENTITY_A
 AuthId_w AS SEC_WINNT_AUTH_IDENTITY_W
 AuthIdEx2 AS SEC_WINNT_AUTH_IDENTITY_EX2
END UNION
'// the credential structure is encrypted via
'// RtlEncryptMemory(OptionFlags = 0)
%EQUATE `SEC_WINNT_AUTH_IDENTITY_FLAGS_PROCESS_ENCRYPTED = &H10
'// the credential structure is protected by local system via
'// RtlEncryptMemory(OptionFlags =
'// IOCTL_KSEC_ENCRYPT_MEMORY_SAME_LOGON)
%EQUATE `SEC_WINNT_AUTH_IDENTITY_FLAGS_SYSTEM_PROTECTED = &H20
%EQUATE `SEC_WINNT_AUTH_IDENTITY_FLAGS_RESERVED = &H10000
%EQUATE `SEC_WINNT_AUTH_IDENTITY_FLAGS_NULL_USER = &H20000
%EQUATE `SEC_WINNT_AUTH_IDENTITY_FLAGS_NULL_DOMAIN = &H40000
'//
'// These bits are for communication between SspiPromptForCredentials()
'// and the credential providers. Do not use these bits for any other
'// purpose.
'//
%EQUATE `SEC_WINNT_AUTH_IDENTITY_FLAGS_SSPIPFC_USE_MASK = &HFF000000
'//
'// Instructs the credential provider to not save credentials itself
'// when caller selects the "Remember my credential" checkbox.
'//
%EQUATE `SEC_WINNT_AUTH_IDENTITY_FLAGS_SSPIPFC_SAVE_CRED_BY_CALLER = &H80000000
'//
'// State of the "Remember my credentials" checkbox.
'// When set, indicates checked; when cleared, indicates unchecked.
'//
%EQUATE `SEC_WINNT_AUTH_IDENTITY_FLAGS_SSPIPFC_SAVE_CRED_CHECKED = &H40000000
%EQUATE `SEC_WINNT_AUTH_IDENTITY_FLAGS_VALID_SSPIPFC_FLAGS = %SEC_WINNT_AUTH_IDENTITY_FLAGS_SSPIPFC_SAVE_CRED_BY_CALLER OR %SEC_WINNT_AUTH_IDENTITY_FLAGS_SSPIPFC_SAVE_CRED_CHECKED
#ENDIF ' // _AUTH_IDENTITY_INFO_DEFINED
'#ifndef _SSPIPFC_NONE_ // the public view
'// begin_ntifs
'typedef PVOID PSEC_WINNT_AUTH_IDENTITY_OPAQUE; // the credential structure is opaque
'// end_ntifs
'#else // the internal view
'typedef PSEC_WINNT_AUTH_IDENTITY_INFO PSEC_WINNT_AUTH_IDENTITY_OPAQUE;
'#endif // _SSPIPFC_NONE_
'//
'// dwFlags parameter of SspiPromptForCredentials():
'//
'//
'// Indicates that the credentials should not be saved if
'// the user selects the 'save' (or 'remember my password')
'// checkbox in the credential dialog box. The location pointed
'// to by the pfSave parameter indicates whether or not the user
'// selected the checkbox.
'//
'// Note that some credential providers won't honour this flag and
'// may save the credentials in a persistent manner anyway if the
'// user selects the 'save' checbox.
'//
%EQUATE `SSPIPFC_SAVE_CRED_BY_CALLER = &H00000001
%EQUATE `SSPIPFC_VALID_FLAGS = %SSPIPFC_SAVE_CRED_BY_CALLER
'#ifndef _SSPIPFC_NONE_ // the public view
'// Use SspiFreeAuthIdentity() to free the buffer returned
'// in ppAuthIdentity.
#IF %DEF(%USEPBDECL)
'DECLARE FUNCTION SspiPromptForCredentialsW LIB "Secur32.dll" ' ALIAS "SspiPromptForCredentialsW" ( DECLARE FUNCTION SspiPromptForCredentialsW LIB "CREDUI.dll" ALIAS "SspiPromptForCredentialsW" ( pszTargetName AS WSTRINGZ, pUiInfo AS CREDUI_INFOW, BYVAL dwAuthError AS DWORD, pszPackage AS WSTRINGZ, pInputAuthIdentity AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE, ppAuthIdentity AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE PTR PTR
 pfSave AS LONG, BYVAL dwFlags AS DWORD ) AS DWORD
#ELSE
DECLARE FUNCTION SspiPromptForCredentialsW LIB "credui.dll" ALIAS "SspiPromptForCredentialsW" ( BYREF pszTargetName AS WSTRINGZ , BYREF pUiInfo AS CREDUI_INFOW , BYVAL dwAuthError AS QUAD , BYREF pszPackage AS WSTRINGZ , BYVAL pInputAuthIdentity AS QUAD , BYREF ppAuthIdentity AS QUAD , BYREF pfSave AS LONG , BYVAL dwFlags AS QUAD ) AS QUAD ' unsigned long
#ENDIF
'// Use SspiFreeAuthIdentity() to free the buffer returned
'// in ppAuthIdentity.
#IF %DEF(%USEPBDECL)
'DECLARE FUNCTION SspiPromptForCredentialsA LIB "Secur32.dll" ' ALIAS "SspiPromptForCredentialsA" ( DECLARE FUNCTION SspiPromptForCredentialsA LIB "CREDUI.dll" ALIAS "SspiPromptForCredentialsA" ( pszTargetName AS ASCIIZ, pUiInfo AS CREDUI_INFOA, BYVAL dwAuthError AS DWORD, pszPackage AS ASCIIZ, pInputAuthIdentity AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE, ppAuthIdentity AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE PTR PTR
 pfSave AS LONG, BYVAL dwFlags AS DWORD ) AS DWORD
#ELSE
DECLARE FUNCTION SspiPromptForCredentialsA LIB "credui.dll" ALIAS "SspiPromptForCredentialsA" ( BYREF pszTargetName AS ASCIIZ , BYREF pUiInfo AS CREDUI_INFOA , BYVAL dwAuthError AS QUAD , BYREF pszPackage AS ASCIIZ , BYVAL pInputAuthIdentity AS QUAD , BYREF ppAuthIdentity AS QUAD , BYREF pfSave AS LONG , BYVAL dwFlags AS QUAD ) AS QUAD ' unsigned long
#ENDIF
#IF %DEF(%UNICODE)
 MACRO SspiPromptForCredentials = SspiPromptForCredentialsW
#ELSE
 MACRO SspiPromptForCredentials = SspiPromptForCredentialsA
#ENDIF
'#endif // _SSPIPFC_NONE_
'#ifdef _SEC_WINNT_AUTH_TYPES
' // Size = 8 bytes
TYPE SEC_WINNT_AUTH_BYTE_VECTOR DWORD
 ByteArrayOffset AS DWORD ' unsigned long // each element is a byte
 ByteArrayLength AS WORD ' unsigned short
END TYPE
' // Size = 24 bytes
TYPE SEC_WINNT_AUTH_DATA DWORD
 CredType AS GUID ' GUID
 CredData AS SEC_WINNT_AUTH_BYTE_VECTOR
END TYPE
' // Size = 28 bytes
TYPE SEC_WINNT_AUTH_PACKED_CREDENTIALS DWORD FILL
 cbHeaderLength AS WORD ' unsigned short // the length of the header
 cbStructureLength AS WORD ' unsigned short // pay load length including the header
 AuthData AS SEC_WINNT_AUTH_DATA
END TYPE
'// {28BFC32F-10F6-4738-98D1-1AC061DF716A}
'static const GUID SEC_WINNT_AUTH_DATA_TYPE_PASSWORD =
' { 0x28bfc32f, 0x10f6, 0x4738, { 0x98, 0xd1, 0x1a, 0xc0, 0x61, 0xdf, 0x71, 0x6a } };
$SEC_WINNT_AUTH_DATA_TYPE_PASSWORD = GUID$("{28BFC32F-10F6-4738-98D1-1AC061DF716A}")
'// {235F69AD-73FB-4dbc-8203-0629E739339B}
'static const GUID SEC_WINNT_AUTH_DATA_TYPE_CERT =
' { 0x235f69ad, 0x73fb, 0x4dbc, { 0x82, 0x3, 0x6, 0x29, 0xe7, 0x39, 0x33, 0x9b } };
$SEC_WINNT_AUTH_DATA_TYPE_CERT = GUID$("{235F69AD-73FB-4dbc-8203-0629E739339B}")
' // Size = 8 bytes
TYPE SEC_WINNT_AUTH_DATA_PASSWORD DWORD
 UnicodePassword AS SEC_WINNT_AUTH_BYTE_VECTOR
END TYPE
'//
'// smartcard cred data
'//
'// {68FD9879-079C-4dfe-8281-578AADC1C100}
'static const GUID SEC_WINNT_AUTH_DATA_TYPE_CSP_DATA =
' { 0x68fd9879, 0x79c, 0x4dfe, { 0x82, 0x81, 0x57, 0x8a, 0xad, 0xc1, 0xc1, 0x0 } };
$SEC_WINNT_AUTH_DATA_TYPE_CSP_DATA = GUID$("{68fd9879-079c-4dfe-8281-578aadc1c100}")
' // Size = 12 bytes
TYPE SEC_WINNT_AUTH_CERTIFICATE_DATA DWORD FILL
 cbHeaderLength AS WORD ' unsigned short
 cbStructureLength AS WORD ' unsigned short
 Certificate AS SEC_WINNT_AUTH_BYTE_VECTOR
END TYPE
' // Size = 8 bytes
TYPE SEC_WINNT_CREDUI_CONTEXT_VECTOR DWORD
 CredUIContextArrayOffset AS DWORD ' ULONG // offset starts at the beginning of
 ' // this structure, and each element is a SEC_WINNT_AUTH_BYTE_VECTOR that
 ' // describes the flat CredUI context returned by SpGetCredUIContext()
 CredUIContextCount AS WORD ' USHORT
END TYPE
' // Size = 8 bytes
TYPE SEC_WINNT_AUTH_SHORT_VECTOR DWORD
 ShortArrayOffset AS DWORD ' ULONG // each element is a short
 ShortArrayCount AS WORD ' USHORT // number of characters
END TYPE
'// free the returned memory using SspiLocalFree
DECLARE FUNCTION SspiGetCredUIContext LIB "credui.dll" ALIAS "SspiGetCredUIContext" ( BYVAL ContextHandle AS QUAD , BYREF CredType AS GUID , BYREF LogonId AS QUAD , BYREF CredUIContexts AS SEC_WINNT_CREDUI_CONTEXT_VECTOR , BYREF TokenHandle AS QUAD ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION SspiUpdateCredentials LIB "credui.dll" ALIAS "SspiUpdateCredentials" ( BYVAL ContextHandle AS QUAD , BYREF CredType AS GUID , BYVAL FlatCredUIContextLength AS QUAD , BYVAL FlatCredUIContext AS BYTE PTR ) AS LONG ' SECURITY_STATUS
' // Size = 52 bytes
TYPE CREDUIWIN_MARSHALED_CONTEXT DWORD
 StructureType AS GUID
 cbHeaderLength AS WORD ' USHORT
 LogonId AS QUAD ' // user's logon id
 MarshaledDataType AS GUID
 MarshaledDataOffset AS DWORD ' ULONG
 MarshaledDataLength AS WORD ' USHORT
END TYPE
' // Size = 24 bytes
TYPE SEC_WINNT_CREDUI_CONTEXT DWORD
 cbHeaderLength AS WORD ' USHORT
 CredUIContextHandle AS DWORD ' HANDLE // the handle to call SspiGetCredUIContext()
 UIInfo AS CREDUI_INFOW PTR ' PCREDUI_INFOW // input from SspiPromptForCredentials()
 dwAuthError AS DWORD ' ULONG // the authentication error
 pInputAuthIdentity AS DWORD ' PSEC_WINNT_AUTH_IDENTITY_OPAQUE
 TargetName AS UNICODE_STRING PTR ' PUNICODE_STRING
END TYPE
'// {3C3E93D9-D96B-49b5-94A7-458592088337}
'static const GUID CREDUIWIN_STRUCTURE_TYPE_SSPIPFC =
'{ 0x3c3e93d9, 0xd96b, 0x49b5, { 0x94, 0xa7, 0x45, 0x85, 0x92, 0x8, 0x83, 0x37 } };
$CREDUIWIN_STRUCTURE_TYPE_SSPIPFC = GUID$("{3C3E93D9-D96B-49b5-94A7-458592088337}")
'// {C2FFFE6F-503D-4c3d-A95E-BCE821213D44}
'static const GUID SSPIPFC_STRUCTURE_TYPE_CREDUI_CONTEXT =
'{ 0xc2fffe6f, 0x503d, 0x4c3d, { 0xa9, 0x5e, 0xbc, 0xe8, 0x21, 0x21, 0x3d, 0x44 } };
$SSPIPFC_STRUCTURE_TYPE_CREDUI_CONTEXT = GUID$("{C2FFFE6F-503D-4c3d-A95E-BCE821213D44}")
' // Size = 24 bytes
TYPE SEC_WINNT_AUTH_PACKED_CREDENTIALS_EX DWORD
 cbHeaderLength AS WORD ' unsigned short
 Flags AS DWORD ' unsigned long // contains the Flags field in
 ' // SEC_WINNT_AUTH_IDENTITY_EX
 PackedCredentials AS SEC_WINNT_AUTH_BYTE_VECTOR
 PackageList AS SEC_WINNT_AUTH_SHORT_VECTOR
END TYPE
'//
'// free the returned memory using SspiLocalFree
'//
DECLARE FUNCTION SspiUnmarshalCredUIContext LIB "credui.dll" ALIAS "SspiUnmarshalCredUIContext" ( BYVAL MarshaledCredUIContext AS BYTE PTR , BYVAL MarshaledCredUIContextLength AS QUAD , BYREF CredUIContext AS SEC_WINNT_CREDUI_CONTEXT ) AS LONG ' SECURITY_STATUS
'#endif // _SEC_WINNT_AUTH_TYPES
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiPrepareForCredRead LIB "Secur32.dll" ALIAS "SspiPrepareForCredRead" ( AuthIdentity AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
 pszTargetName AS WSTRINGZ, pCredmanCredentialType AS DWORD, ppszCredmanTargetName AS ANY ' PCWSTR*
 ) AS LONG
#ELSE
DECLARE FUNCTION SspiPrepareForCredRead LIB "sspicli.dll" ALIAS "SspiPrepareForCredRead" ( BYVAL AuthIdentity AS QUAD , BYREF pszTargetName AS WSTRINGZ , BYREF pCredmanCredentialType AS QUAD , BYREF ppszCredmanTargetName AS ANY ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiPrepareForCredWrite LIB "Secur32.dll" ALIAS "SspiPrepareForCredWrite" ( AuthIdentity AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE, pszTargetName AS WSTRINGZ, ' supply NULL for username-target credentials
 pCredmanCredentialType AS DWORD, ppszCredmanTargetName AS ANY, ' PCWSTR*
 ppszCredmanUserName AS ANY, ' PCWSTR*
 ppCredentialBlob AS ANY, ' PUCHAR *
 pCredentialBlobSize AS DWORD ) AS LONG
#ELSE
DECLARE FUNCTION SspiPrepareForCredWrite LIB "sspicli.dll" ALIAS "SspiPrepareForCredWrite" ( BYVAL AuthIdentity AS QUAD , BYREF pszTargetName AS WSTRINGZ , BYREF pCredmanCredentialType AS QUAD , BYREF ppszCredmanTargetName AS QUAD , BYREF ppszCredmanUserName AS QUAD , BYREF ppCredentialBlob AS QUAD , BYREF pCredentialBlobSize AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiEncryptAuthIdentity LIB "Secur32.dll" ALIAS "SspiEncryptAuthIdentity" ( AuthData AS ANY ) AS LONG ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
#ELSE
DECLARE FUNCTION SspiEncryptAuthIdentity LIB "sspicli.dll" ALIAS "SspiEncryptAuthIdentity" ( BYVAL AuthData AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiDecryptAuthIdentity LIB "Secur32.dll" ALIAS "SspiDecryptAuthIdentity" ( EncryptedAuthData AS ANY ) AS LONG ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
#ELSE
DECLARE FUNCTION SspiDecryptAuthIdentity LIB "sspicli.dll" ALIAS "SspiDecryptAuthIdentity" ( BYVAL EncryptedAuthData AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiIsAuthIdentityEncrypted LIB "Secur32.dll" ALIAS "SspiIsAuthIdentityEncrypted" ( EncryptedAuthData AS ANY ' SEC_WINNT_AUTH_IDENTITY_OPAQUE ) AS BYTE ' BOOLEAN
#ELSE
DECLARE FUNCTION SspiIsAuthIdentityEncrypted LIB "sspicli.dll" ALIAS "SspiIsAuthIdentityEncrypted" ( BYVAL EncryptedAuthData AS QUAD ) AS BYTE ' BOOLEAN
#ENDIF
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'//
'// Convert the _OPAQUE structure passed in to the
'// 3 tuple <username, domainname, 'password'>.
'//
'// Note: The 'strings' returned need not necessarily be
'// in user recognisable form. The purpose of this API
'// is to 'flatten' the _OPAQUE structure into the 3 tuple.
'// User recognisable <username, domainname> can always be
'// obtained by passing NULL to the pszPackedCredentialsString
'// parameter.
'//
'// zero out the pszPackedCredentialsString then
'// free the returned memory using SspiLocalFree()
'//
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiEncodeAuthIdentityAsStrings LIB "Secur32.dll" ALIAS "SspiEncodeAuthIdentityAsStrings" ( pAuthIdentity AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
 ppszUserName AS ANY, ' PCWSTR*
 ppszDomainName AS ANY, ' PCWSTR*
 ppszPackedCredentialsString AS ANY ' PCWSTR*
 ) AS LONG
#ELSE
DECLARE FUNCTION SspiEncodeAuthIdentityAsStrings LIB "sspicli.dll" ALIAS "SspiEncodeAuthIdentityAsStrings" ( BYVAL pAuthIdentity AS QUAD , BYREF ppszUserName AS QUAD , BYREF ppszDomainName AS QUAD , BYREF ppszPackedCredentialsString AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiValidateAuthIdentity LIB "Secur32.dll" ALIAS "SspiValidateAuthIdentity" ( AuthData AS ANY ) AS LONG ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
#ELSE
DECLARE FUNCTION SspiValidateAuthIdentity LIB "sspicli.dll" ALIAS "SspiValidateAuthIdentity" ( BYVAL AuthData AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
'//
'// free the returned memory using SspiFreeAuthIdentity()
'//
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiCopyAuthIdentity LIB "Secur32.dll" ALIAS "SspiCopyAuthIdentity" ( AuthData AS ANY, ) AS LONG ' SEC_WINNT_AUTH_IDENTITY_OPAQUE, AuthDataCopy AS ANY ' SEC_WINNT_AUTH_IDENTITY_OPAQUE ptr ptr
#ELSE
DECLARE FUNCTION SspiCopyAuthIdentity LIB "sspicli.dll" ALIAS "SspiCopyAuthIdentity" ( BYVAL AuthData AS QUAD , BYREF AuthDataCopy AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
'//
'// use only for the memory returned by SspiCopyAuthIdentity().
'// Internally calls SspiZeroAuthIdentity().
'//
#IF %DEF(%USEPBDECL)
DECLARE SUB SspiFreeAuthIdentity LIB "Secur32.dll" ALIAS "SspiFreeAuthIdentity" ( AuthData AS ANY ) ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
#ELSE
DECLARE SUB SspiFreeAuthIdentity LIB "sspicli.dll" ALIAS "SspiFreeAuthIdentity" ( BYVAL AuthData AS QUAD ) ' void
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE SUB SspiZeroAuthIdentity LIB "Secur32.dll" ALIAS "SspiZeroAuthIdentity" ( AuthData AS ANY ) ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
#ELSE
DECLARE SUB SspiZeroAuthIdentity LIB "sspicli.dll" ALIAS "SspiZeroAuthIdentity" ( BYVAL AuthData AS QUAD ) ' void
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE SUB SspiLocalFree LIB "Secur32.dll" ALIAS "SspiLocalFree" ( DataBuffer AS ANY ) ' VOID PTR
#ELSE
DECLARE SUB SspiLocalFree LIB "sspicli.dll" ALIAS "SspiLocalFree" ( BYVAL DataBuffer AS QUAD ) ' void
#ENDIF
'//
'// call SspiFreeAuthIdentity to free the returned AuthIdentity
'// which zeroes out the credentials blob before freeing it
'//
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiEncodeStringsAsAuthIdentity LIB "Secur32.dll" ALIAS "SspiEncodeStringsAsAuthIdentity" ( pszUserName AS WSTRINGZ, pszDomainName AS WSTRINGZ, pszPackedCredentialsString AS WSTRINGZ, ppAuthIdentity AS ANY ) AS LONG ' SEC_WINNT_AUTH_IDENTITY_OPAQUE ptr ptr
#ELSE
DECLARE FUNCTION SspiEncodeStringsAsAuthIdentity LIB "sspicli.dll" ALIAS "SspiEncodeStringsAsAuthIdentity" ( BYREF pszUserName AS WSTRINGZ , BYREF pszDomainName AS WSTRINGZ , BYREF pszPackedCredentialsString AS WSTRINGZ , BYREF ppAuthIdentity AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiCompareAuthIdentities LIB "Secur32.dll" ALIAS "SspiCompareAuthIdentities" ( AuthIdentity1 AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
 AuthIdentity2 AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
 SameSuppliedUser AS BYTE, ' BOOLEAN
 SameSuppliedIdentity AS BYTE ' BOOLEAN
 ) AS LONG
#ELSE
DECLARE FUNCTION SspiCompareAuthIdentities LIB "sspicli.dll" ALIAS "SspiCompareAuthIdentities" ( BYVAL AuthIdentity1 AS QUAD , BYVAL AuthIdentity2 AS QUAD , BYREF SameSuppliedUser AS BYTE , BYREF SameSuppliedIdentity AS BYTE ) AS LONG ' SECURITY_STATUS
#ENDIF
'//
'// zero out the returned AuthIdentityByteArray then
'// free the returned memory using SspiLocalFree()
'//
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiMarshalAuthIdentity LIB "Secur32.dll" ALIAS "SspiMarshalAuthIdentity" ( AuthIdentity AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
 AuthIdentityLength AS DWORD, AuthIdentityByteArray AS ANY ' char**
 ) AS LONG
#ELSE
DECLARE FUNCTION SspiMarshalAuthIdentity LIB "sspicli.dll" ALIAS "SspiMarshalAuthIdentity" ( BYVAL AuthIdentity AS QUAD , BYREF AuthIdentityLength AS LONG , BYREF AuthIdentityByteArray AS STRING ) AS LONG ' SECURITY_STATUS
#ENDIF
'//
'// free the returned auth identity using SspiFreeAuthIdentity()
'//
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiUnmarshalAuthIdentity LIB "Secur32.dll" ALIAS "SspiUnmarshalAuthIdentity" ( BYVAL AuthIdentityLength AS QUAD, BYVAL AuthIdentityByteArray AS BYTE PTR, ppAuthIdentity AS ANY ) AS LONG ' SEC_WINNT_AUTH_IDENTITY_OPAQUE ptr ptr
#ELSE
DECLARE FUNCTION SspiUnmarshalAuthIdentity LIB "sspicli.dll" ALIAS "SspiUnmarshalAuthIdentity" ( BYVAL AuthIdentityLength AS LONG , BYREF AuthIdentityByteArray AS BYTE , BYREF ppAuthIdentity AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
DECLARE FUNCTION SspiIsPromptingNeeded LIB "credui.dll" ALIAS "SspiIsPromptingNeeded" ( BYVAL ErrorOrNtStatus AS QUAD ) AS BYTE ' BOOLEAN
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiGetTargetHostName LIB "Secur32.dll" ALIAS "SspiGetTargetHostName" ( pszTargetName AS WSTRINGZ, pszHostName AS ANY ) AS LONG ' PWSTR*
#ELSE
DECLARE FUNCTION SspiGetTargetHostName LIB "sspicli.dll" ALIAS "SspiGetTargetHostName" ( BYREF pszTargetName AS WSTRINGZ , BYREF pszHostName AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
#IF %DEF(%USEPBDECL)
DECLARE FUNCTION SspiExcludePackage LIB "Secur32.dll" ALIAS "SspiExcludePackage" ( AuthIdentity AS ANY, ' SEC_WINNT_AUTH_IDENTITY_OPAQUE
 pszPackageName AS WSTRINGZ, ppNewAuthIdentity AS ANY ' SEC_WINNT_AUTH_IDENTITY_OPAQUE ptr ptr
 ) AS LONG
#ELSE
DECLARE FUNCTION SspiExcludePackage LIB "sspicli.dll" ALIAS "SspiExcludePackage" ( BYVAL AuthIdentity AS QUAD , BYREF pszPackageName AS WSTRINGZ , BYREF ppNewAuthIdentity AS QUAD ) AS LONG ' SECURITY_STATUS
#ENDIF
'//
'// Common types used by negotiable security packages
'//
%EQUATE `SEC_WINNT_AUTH_IDENTITY_MARSHALLED = &H4 ' // all data is in one buffer
%EQUATE `SEC_WINNT_AUTH_IDENTITY_ONLY = &H8 ' // these credentials are for identity only - no PAC needed
'#endif // NTDDI_VERSION
'//
'// Routines for manipulating packages
'//
' // Size = 20 bytes
TYPE SECURITY_PACKAGE_OPTIONS DWORD
 Size AS DWORD ' unsigned long
 Type AS DWORD ' unsigned long
 Flags AS DWORD ' unsigned long
 SignatureSize AS DWORD ' unsigned long
 Signature AS DWORD ' void *
END TYPE
%EQUATE `SECPKG_OPTIONS_TYPE_UNKNOWN = 0
%EQUATE `SECPKG_OPTIONS_TYPE_LSA = 1
%EQUATE `SECPKG_OPTIONS_TYPE_SSPI = 2
%EQUATE `SECPKG_OPTIONS_PERMANENT = &H00000001
DECLARE FUNCTION AddSecurityPackageA LIB "secur32.dll" ALIAS "AddSecurityPackageA" ( BYREF pszPackageName AS ASCIIZ , BYREF pOptions AS SECURITY_PACKAGE_OPTIONS ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION AddSecurityPackageW LIB "secur32.dll" ALIAS "AddSecurityPackageW" ( BYREF pszPackageName AS WSTRINGZ , BYREF pOptions AS SECURITY_PACKAGE_OPTIONS ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO AddSecurityPackage = AddSecurityPackageW
#ELSE
 MACRO AddSecurityPackage = AddSecurityPackageA
#ENDIF
DECLARE FUNCTION DeleteSecurityPackageA LIB "secur32.dll" ALIAS "DeleteSecurityPackageA" ( BYREF pszPackageName AS ASCIIZ ) AS LONG ' SECURITY_STATUS
DECLARE FUNCTION DeleteSecurityPackageW LIB "secur32.dll" ALIAS "DeleteSecurityPackageW" ( BYREF pszPackageName AS WSTRINGZ ) AS LONG ' SECURITY_STATUS
#IF %DEF(%UNICODE)
 MACRO DeleteSecurityPackage = DeleteSecurityPackageW
#ELSE
 MACRO DeleteSecurityPackage = DeleteSecurityPackageA
#ENDIF
#ENDIF
