C# Call LogonUser fail with SecureString

Question

everyone, I am facing an issue with LogonUser function.

I just want to know if I can import the LogonUser function into C# by this signature:

[DllImport("advapi32.dll", SetLastError = true)]
internal static extern int LogonUser(string username, string domain, IntPtr password, int logonType, int logonProvider, ref IntPtr token);

Because I want to secure my password not using a string, but a SecureString class. Then later the function is used like below:

var passwordPtr = Marshal.SecureStringToGlobalAllocUnicode(password);
var result = LogonUser(userName, domain, passwordPtr, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, ref token);

I always get result = 0 and the message shows that the user name and password is incorrect. But when I change the signature to use string password, then everything works well.

Please help me as to secure the password with SecureString is important to me.

That's how you would do it.. The MSDN page for SecureStringToGlobalAllocUnicode has a complete example for calling LogonUser: msdn.microsoft.com/en-us/library/… — Alex K.
– Alex K., Commented Jan 14, 2015 at 11:50
An obvious issue would be if you've got the P/Invoke signature wrong and are trying to pass Unicode text to the Ansi version of LogonUser - but I can't say for sure since you've not shown your P/Invoke signature. — Damien_The_Unbeliever
– Damien_The_Unbeliever, Commented Jan 14, 2015 at 11:58

Damien_The_Unbeliever · Accepted Answer · 2015-01-14 15:43:17Z

3

As pointed out by Alex K, there's an example of using LogonUser in the SecureStringToGlobalAllocUnicode. Note that the P/Invoke declaration there is:

[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
internal static extern bool LogonUser(String username, String domain, IntPtr password,
            int logonType, int logonProvider, ref IntPtr token);

And that CharSet = CharSet.Unicode has been specified. Unfortunately, for historical reasons, the default CharSet value is Ansi and so that's what your P/Invoke attempt is going to use.

This will be fine for the username parameter since the P/Invoke infrastructure will ensure that it converts the string appropriately. But it's not appropriate for the password parameter since you've already performed the string conversion and you've done it as Unicode - and all that P/Invoke is seeing is an IntPtr now.

I'd suggest updating your P/Invoke signature to match that given in the sample.

Another alternative would be to switch to using SecureStringToGlobalAllocAnsi and leaving your P/Invoke signature alone. But this is a seriously second-rate solution. Writing non-Unicode aware code in 2015 is seriously not to be recommended.

Just get in the habit of always specifying CharSet.Unicode in any P/Invoke signatures you write.

edited Jan 14, 2015 at 15:43

answered Jan 14, 2015 at 15:29

Damien_The_Unbeliever

241k28 gold badges358 silver badges470 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Willie Huang Over a year ago

Thanks Damien_The_Unbeliever and Alex K. I tried to update the signature with charset to Unicode, and it is working fine now. I just didn't realize this settings, and compared many times of the function signature in the article Alex K mentioned:)

Collectives™ on Stack Overflow

C# Call LogonUser fail with SecureString

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related