 | This article needs to beupdated. Please help update this article to reflect recent events or newly available information.(March 2025) |
Security Support Provider Interface (SSPI) is a component ofWindows API that performs security-related operations such asauthentication.
SSPI functions as a common interface to several Security Support Providers (SSPs):[1] A Security Support Provider is adynamic-link library (DLL) that makes one or more security packages available to apps.
The following SSPs are included in Windows:
SSPI is a proprietary variant ofGeneric Security Services Application Program Interface (GSSAPI) with extensions and very Windows-specific data types. It shipped withWindows NT 3.51 andWindows 95 with theNTLMSSP. For Windows 2000, an implementation of Kerberos 5 was added, using token formats conforming to the official protocol standard RFC 1964 (The Kerberos 5 GSSAPI mechanism) and providing wire-level interoperability with Kerberos 5 implementations from other vendors.
The tokens generated and accepted by the SSPI are mostly compatible with the GSS-API so an SSPI client on Windows may be able to authenticate with a GSS-API server on Unix depending on the specific circumstances.
One significant shortcoming of SSPI is its lack ofchannel bindings, which makes some GSSAPI interoperability impossible.
Another fundamental difference between theIETF-defined GSSAPI and Microsoft's SSPI is the concept of "impersonation". In this model, a server can operate with thefull privileges of the authenticated client, so that the operating system performs allaccess control checks, e.g. when opening new files. Whether these are less privileges or more privileges than that of the original service account depends entirely on the client. In the traditional (GSSAPI) model, when a server runs under a service account, it cannot elevate its privileges, and has to perform access control in a client-specific and application-specific fashion. The obvious negative security implications of the impersonation concept are prevented in Windows Vista by restricting impersonation to selected service accounts.[11] Impersonation can be implemented in a Unix/Linux model using theseteuid or related system calls. While this means an unprivileged process cannot elevate its privileges, it also means that to take advantage of impersonation the process must run in the context ofthe root user account.
