Automatic windows credentials login

[xerces8]

(forwarded from the mail list, as suggested)

Is it possible that VNC Viewer automatically logs-in the user to a server ?

Like this :

- server : I add COMPANY\john into the access list

- client :
- john logs into his Windows PC as COMPANY\john
- he runs VNC Viewer to connect to the server
- VNC automatically sends "this is COMPANY\john" to the server,
without asking for this info to be typed by the user

Regards,
xerces8

[Guest]

I was going to ask for the same, it would be great if also worked for the Java viewer

pleeeeaase

[Oliver]

Do you mean all credentials (including password) or just the domain\username?

[xerces8]

user + pass ( and domain of course )

as in : if I connect to a windows network drive, where I am on the ACL, I don't need to re-enter my username and password, ItJustWorks(TM)

[Oliver]

user + pass ( and domain of course )

as in : if I connect to a windows network drive, where I am on the ACL, I don't need to re-enter my username and password, ItJustWorks(TM)

The magic is a different one. And without going deeply into the system you will hardly achieve this with UVNC.

Windows only sends something like an hash over "domain\username+password" over the network and this is compared in the destination machine. That's the whole trick. If you are in a real domain things are a little more complicated, but the above trick is responsible for the fact that if you have the same username and password an machines A and B you can easily authenticate (i.e. transparently without entering passwords) from A to B or vice versa.

[xerces8]

Are you sure there is no (simple) way ?

I understand, that the server might need a patch too.

( and I did some work on windows authentication in Java, so I know the pain )

(besides RealVNC already has this, so maybe someone from there can give a clue)

[Oliver]

Are you sure there is no (simple) way ?

Quite sure.

I understand, that the server might need a patch too.

Maybe a replacement GINA could help ...

( and I did some work on windows authentication in Java, so I know the pain )

(besides RealVNC already has this, so maybe someone from there can give a clue)

We'll have a look into the source of RealVNC. Are you talking of the free flavor of RealVNC?

[xerces8]

No, the enterprise version.

Maybe we have a misunderstanding here.

What I am talking about is : VNC client <-> VNC Server authentication

It appears you are talking about : VNC server <-> windows authentication (at the login screen of the remote PC, where VNC server is running ) ?

[Oliver]

It appears you are talking about : VNC server <-> windows authentication (at the login screen of the remote PC, where VNC server is running ) ?

This is how I understood it. Then what exactly is missing in the VNC authentication process.

BTW: We don't have access to the Enterprise version source.

[Oliver]

Then what exactly is missing in the VNC authentication process.

What I said :

Currently, when I run VNC viewer and connect to a server that uses MS Logon auth,
I must type in :
- username
- password


What I request is :
- VNC viewer takes the username anmd password that I used to log into my PC. Without typing them.


Long version :
- the admin sets up VNC server on host 'moon'
- he activates MS Logon
- he enters the user 'joe' into the ACL

- Joe logs into his work PC ('earth') with his username 'joe' (and password 'shmoe')
- Joe runs VNC viewer and tries to contact the 'moon' server

Current behavior :
- Joe must type 'joe' and 'shmoe' into VNC viewers dialog

Desired behavior :
- VNC viewer sees that it is run by user 'joe' and sends that info to VNC server automatically (Joe does not need to type his username)

Moderated by Oliver at 2005-06-30 10:43:

Corrected quote-tag-level

[Oliver]

What I request is :
- VNC viewer takes the username anmd password that I used to log into my PC. Without typing them.

Let's see how and whether this will be possible. As I said, you will never know the password. The password is being hashed and the hash is compared. So the plain text password is not known (except on some very old flavors of NT).

Will be considered at least!

[xerces8]

Yes, I know that. But :
- just autofilling the username would also be a helpful feature (just prefill the username text filed, so the user can edit it, just as in current version)
- sending the hash and adding support for it in the VNC server might also work

[redge]

like Oliver speak

Marscha, creator of UltravNC MS-Logon, was proposed "Gina" as solution
I remember he warning impact credential and can lock OS usability if something fail at logon screen.
(i did'nt find with search option the text of Marscha about this issue)

I believe to GINA (there not asking again same user/password) single sign on
A must have for V2 to connecto to UltraVNC server. (that make windows login really friendly from any place)
no need vnc authentication othervise only for compatibility with other VNC flavors.

[Rudi De Vos]

A GINA replacement also allow to start winvnc.....

+
I experimented with this as replacing for the service...(interactive service problems)

You just tell the GINA to start winvnc before he show the logon window.
Works on NT,XP,W2K
Works with individual RDP session
Longhorn....solve the service issue

PCanywhere has it own GINA

-
GINA replacenment is dangerous, if it fails you need a boot cd.
Can break compatibility, if custom gina's are already installed
FUS logon screen seems to be broken

[redge]

just autofilling the username would also be a helpful feature (just prefill the username text filed, so the user can edit it, just as in current version)

That would enough workaround othervise than strong safe solution if there too dangerous about "Gina" development. (I believe the futur devs fix bug Gina)

sorry for was confusing Rudi and Marscha about Gina issue.

[Marscha]

Automatic windows credentials logon:
- It is possible
- You don't need a different GINA
- In principle I know how to do it

The solution would be again based on SSPI (same as MSLogon II).
It requires a RFB protocol change.
I.e. you cannot mix MSLogon I or II with the new authentication method.
I assume it will require a considerable amount of time to implement it.

[mellerbeck]

So... be kind to me. Anyways I was thinking about logging on with windows credentials and I noticed that with exchange server 2003 when you access it through the web browser it automatically logs you in. This is because Internet Explorer browser can be configured to pass the credentials you logged onto your computer with to any Web site that requests ‘Integrated’ authentication. I was wondering if you could somehow copycat this somehow to allow for ULtravnc integrated authentication.

Cheers

[redge]

FlexLM like used with xrdp and rdesktop sourceforge ?
is'nt free and ready to use ?

[TKD]

logmein let's you click through w/a cached id and pw to login or unlock the remote pc...

do you want a feature similar to that?

try www.logmein.com and you'll see what i'm talking about.

it's perty good!

[Johnson]

I know that this thread is very old, but I'm looking exactly for the functionality describe by xerces8. Maybe this feature was implemented since this topic was created?

[Rudi De Vos]

Sorry, that's hard to implement and it would only be possible if server and viewer are in the the same domain.

[Johnson]

Thank you very much for answer. In my case, all server and viewer are in the same domain. I understand that it is difficult to implement. I am asking about it because it would be comfortable but nothing will happen to me if I type credential every time.

One more time thank you.

[averkiev]

It seems that this request is about support for SSO (Single Sign-on) capability in UltraVNC. In my experience it is a fairly complicated functionality. Some software have built-in implementation for it, other relies on installation of an optional SSO plug-in modules. It would