如何通过网络连接以编程方式验证Windows用户

Question

Given a windows domain, and two win7 systems, how can I establish a user verified connection from the first computer to the second without prompting for the user to re-enter credentials.

A good summary of this is: A TCP connection, server-side, has no idea what user is originating the connection. How can implementing a TCP based program permit user validation.

Work around ideas: - I could write a WMI provider and use the underlying WMI infrastructure to verify the user.

I'd prefer not to get a work-around, as I've been working around not really understanding how to authenticate over the network using Windows for many years. Please help me to understand how Windows is actually performing this step so that I can implement the technique. If the answer is kerberos some example code on how to generate/send something from the client (without prompting for credentials, just use the logged in user) that the server can process/validate.

---

I think this may have already been answered here: Windows authentication token C++

(Will need some time to implement/test before I will be sure.)

Answer 1

The magic answer I was looking for back then was SSPI (Kerberos) . A similar solution exists with OpenSSL. For others looking for this you will also be interested in SSL, TLS (the new SSL), and SASL (a mechanism for deciding on the fly which identification algorithm to use) and it's Microsoft counterpart SSPI.