Member Avatar for shinkelwars

Hi guys,

Not sure where to ask this so I figured I'll start with C#.

I would like to write a windows service that will allow some external device or authentication provider to log a user into windows.

For example, a finger print reader can log a user into windows via fingerprint instead of password.

Can anyone point me in the right direction in terms of what I need and where I should start researching how to make such a thing?

Thank you.

  • 4 Contributors
  • 4 Replies
  • 122 Views
  • 3 Weeks Discussion Span
  • Latest Post Latest Post by shinkelwars

Dani AI

Generated

Good direction already from and : a plain background service by itself won’t cover the interactive logon case. A practical, maintainable approach is a two-part design: a small, native logon-time component that the OS loads to interact with the secure desktop, and a separate system service that owns the hardware, drivers and enrollment UI.

Keep the logon piece tiny and native so it can load early and do only these things: display minimal UI, ask the service to verify a presented credential, and call the OS back on success. Put all device access, matching algorithms and policy in the service running as LocalSystem. Communicate between the two with a secured IPC channel (restrict the pipe/endpoint ACL, use impersonation, and authenticate both ends). Provide a password fallback and treat enrollment as an out-of-band operation handled by the service, not the logon stub.

On modern Windows, prefer using the platform biometric stack rather than writing low-level drivers: the Windows Biometric Framework and Windows Hello provide standardized APIs and drivers that simplify enrollment and matching across devices (, ). If the hardware vendor supplies a WBF-compatible driver, plug into that instead of reimplementing matching.

Deployment checklist and gotchas: sign binaries; test unlock, workstation lock, Fast User Switching and Remote Desktop scenarios; respect the secure attention sequence and avoid unsupported hooks; plan rollback/uninstall paths; verify IPC ACLs and service account privileges; and test on clean VMs and domain-joined machines. For secure IPC patterns and ACLs see the platform docs on named pipes and IPC (Named Pipes). A short prototype with the two-part pattern will reveal most integration issues quickly.

Recommended Answers

All 4 Replies

Member Avatar for Ramy Mahrous

Windows service run an executable with an silly interface which doesn't allow a user to max, mini, or close it.
Executable will do its job for authentication.

Member Avatar for nelis

I think you're talking about writing a custom gina dll to authenticate a user to the Windows environment, which is what a fingerprint or smarkcard type devices do. I've not written one myself, only have read into it a little. Here's a link to assist:

http://msdn.microsoft.com/en-us/library/aa380543(VS.85).aspx

-Nelis

Member Avatar for TimMCSE

If you want to do something before a user logs in you'll probably need to write a custom gina.dll file or use a hook into the existing microsoft gina.dll

However, you shouldn't write it in C#:

Hi guys,

Not sure where to ask this so I figured I'll start with C#.

I would like to write a windows service that will allow some external device or authentication provider to log a user into windows.

For example, a finger print reader can log a user into windows via fingerprint instead of password.

Can anyone point me in the right direction in terms of what I need and where I should start researching how to make such a thing?

Thank you.

Member Avatar for shinkelwars

Hi guys,

Thanks for all the help, writing a custom Gina.dll is the way to go with XP. And for Vista it's completely different but much easier (by writing a CredentialProvider).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.