Issue with SSO: AcceptSecurityContext: SECURITY_STATUS incorrect only with specific windows machine.

Question

Issue with SSO: AcceptSecurityContext: SECURITY_STATUS incorrect only with specific windows machine.

kytay opened this issue 4 years ago · comments

Describe the bug

Actual use case issue.

I have integrated node-expose-sspi into my application, it worked on my dev windows 10 machine, but after i move my code to another windows 10 machine, it did not work, and start crashing on the application, when the request passes through sso.auth() middleware.

After isolating the middleware, and debug the auth(), I found myself with the following error
UnauthorizedError: Error while doing SSO: AcceptSecurityContext: SECURITY_STATUS incorrect (<0): (error code: 0x80090308) The token supplied to the function is invalid

Basic debugging with simple sso test example
Followed instructions on https://github.com/jlguenego/node-expose-sspi/blob/master/doc/use-case/errors.md for basic debugging
Behaviors observed:

type localhost:3000, application crash with [nodemon] app crashed - waiting for file changes before starting...
type 127.0.0.1:3000, provide correct credential - NTLM authentication works, and sso result is returned in json.
type 127.0.0.1:3000, provide incorrect credential - error is generated in console

UnauthorizedError: SEC_E_LOGON_DENIED. (incorrect login/password, or account disabled, or locked, etc.). Protocol Message = NTLM_AUTHENTICATE_03. at Object.<anonymous> (D:\git.repo\node-expose-sspi\examples\express-simple\node_modules\node-expose-sspi\dist\sso\auth.js:168:62) at step (D:\git.repo\node-expose-sspi\examples\express-simple\node_modules\node-expose-sspi\dist\sso\auth.js:33:23) at Object.next (D:\git.repo\node-expose-sspi\examples\express-simple\node_modules\node-expose-sspi\dist\sso\auth.js:14:53) at D:\git.repo\node-expose-sspi\examples\express-simple\node_modules\node-expose-sspi\dist\sso\auth.js:8:71 at new Promise (<anonymous>) at __awaiter (D:\git.repo\node-expose-sspi\examples\express-simple\node_modules\node-expose-sspi\dist\sso\auth.js:4:12) at D:\git.repo\node-expose-sspi\examples\express-simple\node_modules\node-expose-sspi\dist\sso\auth.js:103:31 at D:\git.repo\node-expose-sspi\examples\express-simple\node_modules\node-expose-sspi\dist\sso\auth.js:225:15 at Layer.handle [as handle_request] (D:\git.repo\node-expose-sspi\examples\express-simple\node_modules\express\lib\router\layer.js:95:5) at trim_prefix (D:\git.repo\node-expose-sspi\examples\express-simple\node_modules\express\lib\router\index.js:317:13)

To Reproduce

To reproduce, the issue is system specific without clear knowledge of what configuration is missing.
Can the observation in the basic debugging above provides a good idea what other test i could try out next?

Trace
Mind to provide some details on what to provide?
I notice that is exposure of hostname and credential details in the stack trace, which i hope i can avoid providing.

Expected behavior
According to the working version of the code running on the previous dev machine, the sso.auth() should function correctly without throwing any error. I expect the request.sso to provide the most minimum details available without AD.

Environment version:

OS: Windows 10
Browser Chrome
Version Version 85.0.4183.121 (Official Build) (64-bit)

Please indicates also:

Are you on a Windows domain ? NO
Can you reach the domain controller ? NO
Do your session have admin privileges ? NO
Which authentication protocol ? NO
Active Directory, or local window policies that could impact the authentication. No AD, how can i provide the policy details?

Additional context
Add any other context about the problem here.

Jean-Louis GUENEGO · Answer 1 · Mon Oct 05 2020 15:06:59 GMT+0800 (China Standard Time)

Hello,

Please provide the node-expose-sspi version. At leat make sure the last version is used. (0.1.44 for the time being).

kytay · Answer 2 · Tue Oct 06 2020 15:21:45 GMT+0800 (China Standard Time)

Hi @jlguenego

Yes the version used is 0.1.44

Jean-Louis GUENEGO · Answer 3 · Sat Oct 10 2020 23:09:44 GMT+0800 (China Standard Time)

The problem I see in your description is only when sso.auth() make the app crash while using http://localhost:3000.

Please indicate for the machine where there is the crash the following:

node version and architecture (ex: 12.19.0 and x64)
windows version (ex: Windows 10 Pro, version 1903, x64)

Please remember this module can run only with :
Microsoft Windows OS, NodeJS version >=12.16.1. Architecture: x64 or ia32.

Thanks.

kytay · Answer 4 · Sun Oct 11 2020 09:46:43 GMT+0800 (China Standard Time)

Hi @jlguenego
The node version i am using node-v12.18.4-win-x64
Windows 10 Pro, Version 2004 - Build 19041.508 x64

Yes, i have encountered issue, such as incompatible nodejs version before, which the runtime exception has been very helpful.
Thanks.

Jean-Louis GUENEGO · Answer 5 · Wed Oct 14 2020 00:41:32 GMT+0800 (China Standard Time)

Is it possible you setup the trace mode ?
The node-expose-sspi module uses the debug module.
So you can setup in your environment the DEBUG variable:

set DEBUG=node-expose-sspi:*

Then rerun the test where the app is crashing (the http://localhost:3000 use case). So we can see where exactly it crashes.
Copy paste the logs on the console here.

Thanks.

kytay · Answer 6 · Tue Oct 20 2020 09:43:24 GMT+0800 (China Standard Time)

Hi @jlguenego

Please find the log below, the hostname and hex ascii has been modified to hide the original hostname, but everything else is still intact.

Thanks.

> express-simple@1.0.0 start D:\git.repo\node-expose-sspi\examples\express-simple
> set DEBUG=node-expose-sspi:* && nodemon server.js

[nodemon] 2.0.4
[nodemon] to restart at any time, enter `rs`
[nodemon] watching path(s): *.*
[nodemon] watching extensions: js,mjs,json
[nodemon] starting `node server.js`
Server started on port 3000
  node-expose-sspi:schManager initCookie +0ms
  node-expose-sspi:auth cookieToken:  NEGOTIATE_7509192712 +0ms
  node-expose-sspi:auth no authorization key in header +1ms
  node-expose-sspi:schManager initCookie +31ms
  node-expose-sspi:auth cookieToken:  NEGOTIATE_7509192712 +39ms
  node-expose-sspi:misc buffer length 133 +0ms
  node-expose-sspi:auth messageType:  NTLM_NEGOTIATE_01 +2ms
  node-expose-sspi:misc buffer length 133 +2ms
  node-expose-sspi:auth 0x00000000:60 81 82 06 06 2b 06 01  05 05 02 a0 78 30 76 a0 : `............0..
  node-expose-sspi:auth 0x00000016:30 30 2e 06 0a 2b 06 01  04 01 82 37 02 02 0a 06 : 00.........7....
  node-expose-sspi:auth 0x00000032:09 2a 86 48 82 f7 12 01  02 02 06 09 2a 86 48 86 : ...H..........H.
  node-expose-sspi:auth 0x00000048:f7 12 01 02 02 06 0a 2b  06 01 04 01 82 37 02 02 : .............7..
  node-expose-sspi:auth 0x00000064:1e a2 42 04 40 4e 54 4c  4d 53 53 50 00 01 00 00 : ..B..NTLMSSP....
  node-expose-sspi:auth 0x00000080:00 97 b2 08 e2 09 00 09  00 37 00 00 00 0f 00 0f : .........7......
  node-expose-sspi:auth 0x00000096:00 28 00 00 00 0a 00 61  4a 00 00 00 0f 53 53 53 : .......aJ....SSS
  node-expose-sspi:auth 0x00000112:53 53 53 53 2d 33 53 56  34 56 52 45 57 4f 52 4b : SSSS.3SV4VREWORK
  node-expose-sspi:auth 0x00000128:47 52 4f 55 50                                  : GROUP
  node-expose-sspi:auth  +13ms
  node-expose-sspi:schManager wait for release with cookie NEGOTIATE_7509192712 +47ms
  node-expose-sspi:auth schManager waitForReleased finished. +37ms
  node-expose-sspi:schManager cookieToken:  NEGOTIATE_7509192712 +16ms
  node-expose-sspi:auth input just before calling AcceptSecurityContext {
  credential: '0x000001937be4c570.0x000002ad23469a90',
  SecBufferDesc: { ulVersion: 0, buffers: [ [ArrayBuffer] ] }
} +13ms
  node-expose-sspi:auth serverSecurityContext just after AcceptSecurityContext {
  contextHandle: '0x000001937bf0bbe0.0x000002ad23469a90',
  contextAttr: [
    'ASC_RET_REPLAY_DETECT',
    'ASC_RET_SEQUENCE_DETECT',
    'ASC_RET_CONNECTION'
  ],
  SecBufferDesc: { ulVersion: 0, buffers: [ [ArrayBuffer] ] },
  SECURITY_STATUS: 'SEC_I_CONTINUE_NEEDED'
} +4ms
  node-expose-sspi:auth AcceptSecurityContext output buffer +15ms
  node-expose-sspi:misc buffer length 271 +82ms
  node-expose-sspi:auth 0x00000000:a1 82 01 0b 30 82 01 07  a0 03 0a 01 01 a1 0c 06 : ....0...........
  node-expose-sspi:auth 0x00000016:0a 2b 06 01 04 01 82 37  02 02 0a a2 81 f1 04 81 : .......7........
  node-expose-sspi:auth 0x00000032:ee 4e 54 4c 4d 53 53 50  00 02 00 00 00 1e 00 1e : .NTLMSSP........
  node-expose-sspi:auth 0x00000048:00 38 00 00 00 15 c2 8a  e2 fe af f1 10 87 44 9f : .8............D.
  node-expose-sspi:auth 0x00000064:7f 02 00 01 00 00 00 00  00 98 00 98 00 56 00 00 : .............V..
  node-expose-sspi:auth 0x00000080:00 0a 00 61 4a 00 00 00  0f 53 00 53 00 53 00 53 : ...aJ....S.S.S.S
  node-expose-sspi:auth 0x00000096:00 53 00 53 00 53 00 2d  00 33 00 53 00 56 00 34 : .S.S.S...3.S.V.4
  node-expose-sspi:auth 0x00000112:00 56 00 52 00 45 00 02  00 1e 00 53 00 53 00 53 : .V.R.E.....S.S.S
  node-expose-sspi:auth 0x00000128:00 53 00 53 00 53 00 53  00 2d 00 33 00 53 00 56 : .S.S.S.S...3.S.V
  node-expose-sspi:auth 0x00000144:00 34 00 56 00 52 00 45  00 01 00 1e 00 53 00 53 : .4.V.R.E.....S.S
  node-expose-sspi:auth 0x00000160:00 53 00 53 00 53 00 53  00 53 00 2d 00 33 00 53 : .S.S.S.S.S...3.S
  node-expose-sspi:auth 0x00000176:00 56 00 34 00 56 00 52  00 45 00 04 00 1e 00 53 : .V.4.V.R.E.....S
  node-expose-sspi:auth 0x00000192:00 53 00 53 00 53 00 53  00 53 00 53 00 2d 00 33 : .S.S.S.S.S.S...3
  node-expose-sspi:auth 0x00000208:00 53 00 56 00 34 00 56  00 52 00 45 00 03 00 1e : .S.V.4.V.R.E....
  node-expose-sspi:auth 0x00000224:00 53 00 53 00 53 00 53  00 53 00 53 00 53 00 2d : .S.S.S.S.S.S.S..
  node-expose-sspi:auth 0x00000240:00 33 00 53 00 56 00 34  00 56 00 52 00 45 00 07 : .3.S.V.4.V.R.E..
  node-expose-sspi:auth 0x00000256:00 08 00 50 94 c6 05 81  a6 d6 01 00 00 00 00    : ...P...........
  node-expose-sspi:auth  +2ms
  node-expose-sspi:schManager initCookie +53ms
  node-expose-sspi:auth cookieToken:  NEGOTIATE_7509192712 +29ms
  node-expose-sspi:misc buffer length 121 +31ms
  node-expose-sspi:auth messageType:  NTLM_AUTHENTICATE_03 +1ms
  node-expose-sspi:misc buffer length 121 +0ms
  node-expose-sspi:auth 0x00000000:a1 77 30 75 a0 03 0a 01  01 a2 5a 04 58 4e 54 4c : ..0.......Z.XNTL
  node-expose-sspi:auth 0x00000016:4d 53 53 50 00 03 00 00  00 00 00 00 00 58 00 00 : MSSP.........X..
  node-expose-sspi:auth 0x00000032:00 00 00 00 00 58 00 00  00 00 00 00 00 58 00 00 : .....X.......X..
  node-expose-sspi:auth 0x00000048:00 00 00 00 00 58 00 00  00 00 00 00 00 58 00 00 : .....X.......X..
  node-expose-sspi:auth 0x00000064:00 00 00 00 00 58 00 00  00 15 c2 88 e2 0a 00 61 : .....X.........a
  node-expose-sspi:auth 0x00000080:4a 00 00 00 0f 26 2d e0  e7 3f 26 60 f4 51 1a 75 : J..........`.Q..
  node-expose-sspi:auth 0x00000096:72 d9 38 ba fa a3 12 04  10 01 00 00 00 ac 6d 97 : ..8º..........m.
  node-expose-sspi:auth 0x00000112:da 2b 8b 5e 02 00 00 00  00                      : .........
  node-expose-sspi:auth  +1ms
  node-expose-sspi:schManager cookieToken:  NEGOTIATE_7509192712 +14ms
  node-expose-sspi:auth adding to input a serverContextHandle (not first exchange) +15ms
  node-expose-sspi:auth input just before calling AcceptSecurityContext {
  credential: '0x000001937be4c570.0x000002ad23469a90',
  SecBufferDesc: { ulVersion: 0, buffers: [ [ArrayBuffer] ] },
  contextHandle: '0x000001937bf0bbe0.0x000002ad23469a90'
} +1ms
  node-expose-sspi:auth serverSecurityContext just after AcceptSecurityContext {
  contextHandle: '0x000001937bd5a0c0.0x000002ad23469f90',
  contextAttr: [
    'ASC_RET_REPLAY_DETECT',
    'ASC_RET_SEQUENCE_DETECT',
    'ASC_RET_INTEGRITY'
  ],
  SecBufferDesc: { ulVersion: 0, buffers: [ [ArrayBuffer] ] },
  SECURITY_STATUS: 'SEC_E_OK'
} +4ms
  node-expose-sspi:auth AcceptSecurityContext output buffer +12ms
  node-expose-sspi:misc buffer length 29 +33ms
  node-expose-sspi:auth 0x00000000:a1 1b 30 19 a0 03 0a 01  00 a3 12 04 10 01 00 00 : ..0.............
  node-expose-sspi:auth 0x00000016:00 4c 95 ac 96 74 7f 9b  cd 00 00 00 00          : .L...........
  node-expose-sspi:auth  +1ms
  node-expose-sspi:schManager cookieToken:  NEGOTIATE_7509192712 +31ms
  node-expose-sspi:SSO impersonate security context ok +0ms
  node-expose-sspi:SSO userToken:  0x0000000000000390 +0ms
[nodemon] app crashed - waiting for file changes before starting...

Jean-Louis GUENEGO · Answer 7 · Fri Oct 23 2020 22:47:43 GMT+0800 (China Standard Time)

Looks like the (NTLM) authentication is done right, but the crash problem occurs a little bit after while trying to get information from the userToken.

It seems the problem is raised in the SSO.ts file. You have something on your computer that lead to a crash, without the willing to raise an exception...

    debug('impersonate security context ok');
    const userToken = sspi.OpenThreadToken();
    debug('userToken: ', userToken);
    try {
      this.user.displayName = sspi.GetUserNameEx('NameDisplay');
    } catch (e) {
      // exemple of error scenario: local user without displayname.
      this.user.displayName = this.user.name;
    }
    sspi.RevertSecurityContext(this.serverContextHandle);

    if (this.options.useGroups) {
      const groups = sspi.GetTokenInformation({
        accessToken: userToken,
        tokenInformationClass: 'TokenGroups',
        filter: this.options.groupFilterRegex,
      });
      groups.sort();
      debug('groups: ', groups);
      this.user.groups = groups;
    }

    // free the userToken
    sspi.CloseHandle(userToken);

    const { sid } = sspi.LookupAccountName(names.sUserName);
    this.user.sid = sid;

    try {
      if (
        sso.isOnDomain() &&
        sso.isActiveDirectoryReachable() &&
        os.hostname() !== domain &&
        this.options.useActiveDirectory
      ) {
        const adUser = await getUser(`(sAMAccountName=${name})`);
        this.user.adUser = adUser;
      }
    } catch (e) {
      debug('cannot getUser from AD. e: ', e);
    }

    // owner info.
    if (this.options.useOwner) {
      const owner = sspi.GetUserName();
      debug('owner: ', owner);
      this.owner = { name: owner };
      try {
        this.owner.displayName = sspi.GetUserNameEx('NameDisplay');
      } catch (e) {
        // exemple of error scenario: local user without displayname.
        this.owner.displayName = this.owner.name;
      }

      if (this.options.useGroups) {
        const processToken = sspi.OpenProcessToken([
          'TOKEN_QUERY',
          'TOKEN_QUERY_SOURCE',
        ]);
        const ownerGroups = sspi.GetTokenInformation({
          accessToken: processToken,
          tokenInformationClass: 'TokenGroups',
          filter: this.options.groupFilterRegex,
        });
        ownerGroups.sort();
        debug('ownerGroups: ', ownerGroups);
        this.owner.groups = ownerGroups;
        sspi.CloseHandle(processToken);
      }

      try {
        const o = sspi.LookupAccountName(owner);
        this.owner.sid = o.sid;
        this.owner.domain = o.domain;
      } catch (e) {}
    }
  }

To investigate is it possible that you clone the project and insert more debug to understand exactly which is the function call that lead to the crash ?

Or I can release a version with more debug info.

Thanks.

Jean-Louis GUENEGO · Answer 8 · Fri Oct 23 2020 23:02:40 GMT+0800 (China Standard Time)

I have released the 0.1.46 version with all debug info in the SSO.ts file. Please could you bring back the log of the crash as well ?
Thanks.

kytay · Answer 9 · Thu Oct 29 2020 14:47:27 GMT+0800 (China Standard Time)

Hi @jlguenego

In my last test using the latest 0.1.47, the issue seems to have resolved.

Please refer to logs below, hostname has been removed from logs

D:\git.repo\node-expose-sspi\examples\express-simple>npm run-script start  

> express-simple@1.0.0 start D:\git.repo\node-expose-sspi\examples\express-simple
> set DEBUG=node-expose-sspi:* && nodemon server.js

[nodemon] 2.0.4
[nodemon] to restart at any time, enter `rs`
[nodemon] watching path(s): *.*
[nodemon] watching extensions: js,mjs,json
[nodemon] starting `node server.js`
Server started on port 3000
  node-expose-sspi:schManager initCookie +0ms
  node-expose-sspi:auth cookieToken:  NEGOTIATE_6264650279 +0ms
  node-expose-sspi:auth no authorization key in header +0ms
  node-expose-sspi:schManager initCookie +17ms
  node-expose-sspi:auth cookieToken:  NEGOTIATE_6264650279 +6ms
  node-expose-sspi:misc buffer length 40 +0ms
  node-expose-sspi:auth messageType:  NTLM_NEGOTIATE_01 +18ms
  node-expose-sspi:misc buffer length 40 +35ms
  node-expose-sspi:auth 0x00000000:4e 54 4c 4d 53 53 50 00  01 00 00 00 97 82 08 e2 : NTLMSSP.........
  node-expose-sspi:auth 0x00000016:00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 : ................
  node-expose-sspi:auth 0x00000032:0a 00 61 4a 00 00 00 0f                          : ..aJ....
  node-expose-sspi:auth  +19ms
  node-expose-sspi:schManager wait for release with cookie NEGOTIATE_6264650279 +39ms
  node-expose-sspi:auth schManager waitForReleased finished. +3ms
  node-expose-sspi:schManager cookieToken:  NEGOTIATE_6264650279 +2ms
  node-expose-sspi:auth input just before calling AcceptSecurityContext {
  credential: '0x000001e2e95e8710.0x000001a744eb8ff0',
  SecBufferDesc: { ulVersion: 0, buffers: [ [ArrayBuffer] ] }
} +2ms
  node-expose-sspi:auth serverSecurityContext just after AcceptSecurityContext {
  contextHandle: '0x000001e2e9337220.0x000001a74690ded0',
  contextAttr: [
    'ASC_RET_REPLAY_DETECT',
    'ASC_RET_SEQUENCE_DETECT',
    'ASC_RET_CONNECTION'
  ],
  SecBufferDesc: { ulVersion: 0, buffers: [ [ArrayBuffer] ] },
  SECURITY_STATUS: 'SEC_I_CONTINUE_NEEDED'
} +4ms
  node-expose-sspi:auth AcceptSecurityContext output buffer +4ms
  node-expose-sspi:misc buffer length 238 +14ms
  node-expose-sspi:auth 0x00000000:4e 54 4c 4d 53 53 50 00  02 00 00 00 1e 00 1e 00 : NTLMSSP.........
  node-expose-sspi:auth 0x00000016:38 00 00 00 15 82 8a e2  ed ca 69 55 b2 62 b1 b4 : 8.........iU.b..
  node-expose-sspi:auth 0x00000032:00 00 00 00 00 00 00 00  98 00 98 00 56 00 00 00 : ............V...

  node-expose-sspi:auth 0x00000224:08 00 b1 88 27 cc be ad  d6 01 00 00 00 00       : ......¾.......
  node-expose-sspi:auth  +1ms
  node-expose-sspi:schManager initCookie +45ms
  node-expose-sspi:auth cookieToken:  NEGOTIATE_6264650279 +55ms
  node-expose-sspi:misc buffer length 484 +57ms
  node-expose-sspi:auth messageType:  NTLM_AUTHENTICATE_03 +2ms
  node-expose-sspi:misc buffer length 484 +2ms
  node-expose-sspi:auth 0x00000000:4e 54 4c 4d 53 53 50 00  03 00 00 00 18 00 18 00 : NTLMSSP.........
  node-expose-sspi:auth 0x00000016:84 00 00 00 38 01 38 01  9c 00 00 00 00 00 00 00 : ....8.8.........
  node-expose-sspi:auth 0x00000032:58 00 00 00 0e 00 0e 00  58 00 00 00 1e 00 1e 00 : X.......X.......
  node-expose-sspi:auth 0x00000048:66 00 00 00 10 00 10 00  d4 01 00 00 15 82 88 e2 : f...............
  node-expose-sspi:auth 0x00000064:0a 00 61 4a 00 00 00 0f  9e 11 9f b9 22 bb d4 62 : ..aJ.........».b
  node-expose-sspi:auth 0x00000080:62 1d 6d 90 3d 41 06 ce  6b 00 61 00 69 00 79 00 : b.m..A..k.a.i...

  node-expose-sspi:auth 0x00000144:00 00 00 00 00 00 00 00  00 00 00 00 32 cc fe 70 : ............2...
  node-expose-sspi:auth 0x00000160:44 bd 46 6e 98 c9 a9 7c  30 ff 04 cf 01 01 00 00 : D½Fn....0.......
  node-expose-sspi:auth 0x00000176:00 00 00 00 b1 88 27 cc  be ad d6 01 5b ea e7 76 : ........¾.......

  node-expose-sspi:auth 0x00000336:07 00 08 00 b1 88 27 cc  be ad d6 01 06 00 04 00 : ........¾.......
  node-expose-sspi:auth 0x00000352:02 00 00 00 08 00 30 00  30 00 00 00 00 00 00 00 : ......0.0.......
  node-expose-sspi:auth 0x00000368:01 00 00 00 00 20 00 00  65 3b 32 82 0a b9 c1 80 : ..... ..e.2.....
  node-expose-sspi:auth 0x00000384:e1 9d eb 9f 88 97 b8 4c  05 81 ad e5 cc 92 58 ab : .......L......X.
  node-expose-sspi:auth 0x00000400:8d 86 0b 3e 8d 3f ab 6a  0a 00 10 00 00 00 00 00 : .......j........
  node-expose-sspi:auth 0x00000416:00 00 00 00 00 00 00 00  00 00 00 00 09 00 1c 00 : ................
  node-expose-sspi:auth 0x00000432:48 00 54 00 54 00 50 00  2f 00 6c 00 6f 00 63 00 : H.T.T.P...l.o.c.
  node-expose-sspi:auth 0x00000448:61 00 6c 00 68 00 6f 00  73 00 74 00 00 00 00 00 : a.l.h.o.........
  node-expose-sspi:auth 0x00000464:00 00 00 00 25 9c de 2a  aa 40 81 28 e5 ba c3 bd : ......Þ......º.½
  node-expose-sspi:auth 0x00000480:26 4c 26 af                                     : .L..
  node-expose-sspi:auth  +1ms
  node-expose-sspi:schManager cookieToken:  NEGOTIATE_6264650279 +62ms
  node-expose-sspi:auth adding to input a serverContextHandle (not first exchange) +40ms
  node-expose-sspi:auth input just before calling AcceptSecurityContext {
  credential: '0x000001e2e95e8710.0x000001a744eb8ff0',
  SecBufferDesc: { ulVersion: 0, buffers: [ [ArrayBuffer] ] },
  contextHandle: '0x000001e2e9337220.0x000001a74690ded0'
} +0ms
  node-expose-sspi:auth serverSecurityContext just after AcceptSecurityContext {
  contextHandle: '0x000001e2e9337220.0x000001a74690ded0',
  contextAttr: [
    'ASC_RET_REPLAY_DETECT',
    'ASC_RET_SEQUENCE_DETECT',
    'ASC_RET_INTEGRITY'
  ],
  SecBufferDesc: { ulVersion: 0, buffers: [ [ArrayBuffer] ] },
  SECURITY_STATUS: 'SEC_E_OK'
} +26ms
  node-expose-sspi:auth AcceptSecurityContext output buffer +5ms
  node-expose-sspi:misc buffer length 0 +71ms
  node-expose-sspi:auth  +1ms
  node-expose-sspi:schManager cookieToken:  NEGOTIATE_6264650279 +33ms
  node-expose-sspi:SSO impersonate security context ok +0ms
  node-expose-sspi:SSO userToken:  0x0000000000000398 +0ms
  node-expose-sspi:SSO about to do GetUserNameEx +1ms
  node-expose-sspi:SSO about to do RevertSecurityContext +0ms
  node-expose-sspi:SSO this.options.useGroups:  true +1ms
  node-expose-sspi:SSO about to do GetTokenInformation +16ms
  node-expose-sspi:SSO groups:  [
  'BUILTIN\\Administrators',
  'BUILTIN\\Users',
  'Mandatory Label\\Medium Mandatory Level',
  'NT AUTHORITY\\Authenticated Users',
  'NT AUTHORITY\\Local account',
  'NT AUTHORITY\\Local account and member of Administrators group',
  'NT AUTHORITY\\NETWORK',
  'NT AUTHORITY\\NTLM Authentication',
  'NT AUTHORITY\\This Organization',
  '\\Everyone'
] +4ms
  node-expose-sspi:SSO about to do CloseHandle +40ms
  node-expose-sspi:SSO about to do LookupAccountName +0ms
  node-expose-sspi:SSO about to do isOnDomain and isActiveDirectoryReachable +1ms
  node-expose-sspi:SSO this.options.useOwner:  false +0ms

kytay · Answer 10 · Thu Nov 19 2020 09:38:36 GMT+0800 (China Standard Time)

Hi @jlguenego

Am I supposed to close the issue?

😅

Not really sure about who is to close the issue if it is resolved.

Thanks for the help.

Best Regards.

Jean-Louis GUENEGO · Answer 11 · Thu Nov 19 2020 22:54:05 GMT+0800 (China Standard Time)

ok I close it ;)