Authenticated RPC Routines

rpc_binding_set_auth_info( )
A client calls this routine to establish an authentication service, protection level, and authorization service for a server binding handle. The client identifies the server by supplying the server's principal name. The RPC runtime, in conjunction with the security service, applies the authentication service and protection level to all subsequent remote procedure calls made using the binding handle.

rpc_binding_inq_auth_info( )
A client calls this routine to return the authentication service, protection level, and authorization service that are in effect for a specified server binding handle. This routine also returns the principal name of the server associated with the binding handle.

rpc_mgmt_inq_dflt_protect_level( )
A client or a server calls this routine to learn the default protection level that is in force for a given authentication service.

rpc_mgmt_inq_server_princ_name( )
A client, a server, or a server manager can call this routine to return the principal name that a server has registered with the RPC runtime via the rpc_server_register_auth_info( ) routine. A client can identify the desired server by supplying a server binding handle and the authentication service associated with the registered principal name.

rpc_server_register_auth_info( )
A server calls this routine to register an authentication service that it wants to support and the server principal name to be associated with the registered service. The server can also optionally supply the address of a key retrieval routine to be called by the security service as part of the client authentication process. The routine is a user-supplied function whose purpose is to provide the server's key to the DCE security runtime.

Note that the server registers only an authentication service. It does not establish a protection level or an authorization service. These are the responsibilities of the client.

rpc_binding_inq_auth_caller( )
A server calls this routine to return the authentication service, protection level, and authorization service that is associated with the binding handle of an authenticated client. This call also returns the server principal name specified by the client on its call to rpc_binding_set_auth_info( ).

rpc_mgmt_set_authorization_fn( )
A server calls this routine to establish a user-supplied authorization function to validate remote client calls to the server's management routines. For example, the user function can call rpc_binding_inq_auth_caller( ) to return authentication and authorization information about the calling client. The RPC runtime calls the user-supplied function whenever it receives a client request to execute one of the following server management routines:

· rpc_mgmt_inq_if_ids( )

· rpc_mgmt_inq_server_princ_name( )

· rpc_mgmt_inq_stats( )

· rpc_mgmt_is_server_listening( )

· rpc_mgmt_stop_server_listening( )

When an unauthenticated client calls a server that has specified authentication, the RPC runtime will not perform any authentication, and the call will reach the application manager code. It is up to the manager to decide how to deal with the unauthenticated call.

Typically, servers and clients establish authentication as follows:

· The server specifies an authentication service for a principal identity under which it runs by calling rpc_server_register_auth_info( ). The authentication service is specified by the authn_svc parameter of this call. Currently, servers may specify either DCE secret key authentication (by supplying either rpc_c_authn_dce_secret or rpc_c_authn_default) or no authentication (by supplying rpc_c_authn_none). The specified authentication service will be used if it is also requested by the client.

· The client sets authentication for a binding handle by calling rpc_binding_set_auth_info( ). The choices are also currently either DCE secret key or no authentication. Client calls made on the binding handle attempt to use the specified authentication service.

· The server manager code calls rpc_binding_inq_auth_caller( ) to extract any authorization information from the client binding for the call.