Extensible Authentication Protocol

Purpose

Extensible Authentication Protocol (EAP) makes it possible to integrate third-party authentication modules into the Remote Access Service (RAS) of Microsoft® Windows® 2000.

EAP is an extension to PPP, that provides a standard support mechanism for authentication schemes such as token cards, Kerberos, Public Key, and S/Key. EAP makes it possible to augment RAS authentication with third-party security devices.

Where Applicable

EAP is a crucial component for protecting the security of Virtual Private Networks (VPN). EAP is useful in any environment where VPNs must be protected against password guessing by dictionary and other types of brute force attacks.

EAP improves on previous authentication protocols such as Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP). Windows 2000 continues to support these earlier authentication protocols as well.

Developer Audience

The EAP API is designed for use by C/C++ programmers working with RAS. Programmers should be familiar with networking concepts.

Run-Time Requirements

EAP is supported on RAS servers and clients running Microsoft® Windows® 2000. EAP is also supported on Windows 2000 Servers running Internet Authentication Service (IAS). For more specific information about which operating systems support a particular function, refer to the Requirements sections in the documentation.

See Also

Remote Access Service

Internet Authentication Service

Overview

General information about the Extensible Authentication Protocol.

Reference

Documentation of functions, structures, and other reference elements used to program the Extensible Authentication Protocol.

Feedback

Make error reports and feature requests directly to Microsoft.

Microsoft Platform SDK, February 2001 Edition.
This content last built on Thursday, February 01, 2001.


About Extensible Authentication Protocol

Microsoft® Windows® 2000 supports the Extensible Authentication Protocol (EAP). EAP allows third-party authentication modules to interact with the implementation of the Point-to-Point Protocol (PPP) included in Windows 2000 Remote Access Service (RAS).

EAP is an extension to PPP, providing a standard support mechanism for authentication schemes such as token cards, Kerberos, Public Key, and S/Key. EAP has been made available in response to increasing demand to augment RAS authentication with third-party security devices. EAP is a critical technology component for secure Virtual Private Networks (VPN), protecting them against brute force or dictionary attacks and password guessing.

The EAP server functionality is supported on Windows 2000 RAS Server. The EAP client is supported on Windows 2000 Professional. However, the RAS server provided with Windows 2000 Professional does not support EAP server functionality.

EAP improves on previous authentication protocols such as Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP). Windows 2000 supports these earlier authentication protocols as well.

This documentation describes the following topics:

  • EAP and Internet Authentication Service
  • EAP Installation
  • User Authentication
  • EAP Implementation Details
  • Configuration User Interface
  • Obtaining Identity Information
  • Interactive User Interface
  • Multilink and Callback Connections


EAP and Internet Authentication Service

The Extensible Authentication Protocol (EAP) is supported on RAS servers running Microsoft® Windows® 2000. It is also supported on Windows 2000 Servers running Internet Authentication Service (IAS). IAS provides remote authentication services using Remote Access Dial-In User Service (RADIUS). The following documentation is applicable to implementing an EAP on a RAS server or on an IAS server.


EAP Installation

Vendors implement EAPs, also known as authentication protocols, in dynamic-link libraries (DLLs). A DLL for the authentication protocol must reside on both the client and server computers. For simplicity, the client and server DLLs may be identical; however, this is not a requirement. Also, note that the same DLL may support more than one authentication protocol.

The vendor should provide setup software to install and remove the DLL. The setup software should also create the appropriate keys and values for the authentication protocol in the system registry. The installation of each EAP DLL should create the following registry key.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\PPP\EAP\<eaptypeid>

In the preceding path, <eaptypeid> is the ID of the authentication protocol. The vendor must obtain this ID from the Internet Assigned Numbers Authority (IANA).

The setup software should remove this key when uninstalling the DLL. The system removes this key if the user uninstalls RAS.

For a description of the supported values for this key, see Authentication Protocol Registry Values.


Authentication Protocol Registry Values

The setup software for the EAP DLL may create the following registry values below <eaptypeid>. These registry values are defined in the Raseapif.h header file. The RAS_EAP_VALUENAME_PATH and RAS_EAP_VALUENAME_FRIENDLY_NAME values are required. The setup software may create other keys and values as well. These could be used by the authentication protocol itself. For an example of registry configuration, see Registry Values Example.

RAS_EAP_VALUENAME_PATH

RAS_EAP_VALUENAME_FRIENDLY_NAME

RAS_EAP_VALUENAME_CONFIGUI

RAS_EAP_VALUENAME_DEFAULT_DATA

RAS_EAP_VALUENAME_REQUIRE_CONFIGUI

RAS_EAP_VALUENAME_CONFIG_CLSID

RAS_EAP_VALUENAME_IDENTITY

RAS_EAP_VALUENAME_INTERACTIVEUI

RAS_EAP_VALUENAME_INVOKE_NAMEDLG

RAS_EAP_VALUENAME_INVOKE_PWDDLG

RAS_EAP_VALUENAME_ENCRYPTION

RAS_EAP_VALUENAME_STANDALONE_SUPPORTED

RAS_EAP_VALUENAME_PATH

Constant Value | Path
Type | REG_EXPAND_SZ
Description | Specifies the path to the EAP DLL.

RAS_EAP_VALUENAME_FRIENDLY_NAME

Constant Value | FriendlyName
Type | REG_SZ
Description | Specifies a friendly name for the authentication protocol. This name will appear in the Dial-Up Networking user interface.

RAS_EAP_VALUENAME_CONFIGUI

Constant Value | ConfigUIPath
Type | REG_EXPAND_SZ
Description | Specifies the path to the DLL that implements the configuration user interface.

RAS_EAP_VALUENAME_DEFAULT_DATA

Constant Value | ConfigData
Type | REG_BINARY
Description | Specifies default configuration data for the authentication protocol.

RAS_EAP_VALUENAME_REQUIRE_CONFIGUI

Constant Value | RequireConfigUI
Type | REG_DWORD
Description | Specifies whether the user must provide configuration data in the Dial-Up Networking user interface. If this value is 1, the user will not be allowed to exit the Dial-Up Networking UI without providing configuration data. The default value is 0.

RAS_EAP_VALUENAME_CONFIG_CLSID

Constant Value | ConfigCLSID
Type | REG_SZ
Description | Specifies the class ID of the configuration UI on the server.

RAS_EAP_VALUENAME_IDENTITY

Constant Value | IdentityPath
Type | REG_EXPAND_SZ
Description | Specifies the path to the DLL that implements functions to obtain the user's identity.

RAS_EAP_VALUENAME_INTERACTIVEUI

Constant Value | InteractiveUIPath
Type | REG_EXPAND_SZ
Description | Specifies the path to the DLL that implements the interactive user interface.

RAS_EAP_VALUENAME_INVOKE_NAMEDLG

Constant Value | InvokeUsernameDialog
Type | REG_DWORD
Description | Specifies whether RAS should display the standard Windows NT/2000 user name dialog (value of 1) or invoke RasEapGetIdentity (value of 0). The default value is 1.

RAS_EAP_VALUENAME_INVOKE_PWDDLG

Constant Value | InvokePasswordDialog
Type | REG_DWORD
Description | Specifies whether RAS should display the standard Windows NT/2000 password dialog. If this value exists and is 0, RAS will not display the password dialog. The default value is 1.

RAS_EAP_VALUENAME_ENCRYPTION

Constant Value | MPPEEncryptionSupported
Type | REG_DWORD
Description | If this value is 1, the authentication protocol can generate keys for the Microsoft Point-to-Point Encryption (MPPE) style of encryption. Possible values are 0 or 1. The default value is 0.

RAS_EAP_VALUENAME_STANDALONE_SUPPORTED

Constant Value | StandaloneSupported
Type | REG_DWORD
Description | Specifies whether this authentication protocol is supported on stand-alone Windows 2000 servers. A value of 0 indicates that the EAP is not supported. The default value is 1.


Registry Values Example

The following example shows possible data for some of the authentication protocol registry values.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\PPP\EAP\40
  Path               (REG_EXPAND_SZ)  %SystemRoot%\system32\sample.dll
  FriendlyName       (REG_SZ)         Sample EAP Protocol
  ConfigUIPath       (REG_EXPAND_SZ)  %SystemRoot%\system32\sample.dll
  IdentityPath       (REG_EXPAND_SZ)  %SystemRoot%\system32\sample.dll
  InteractiveUIPath  (REG_EXPAND_SZ)  %SystemRoot%\system32\sample.dll
  RequireConfigUI    (REG_DWORD)      1
  ConfigCLSID        (REG_SZ)   {0000031A-0000-0000-C000-000000000046}
  StandaloneSupported  (REG_DWORD)    1


User Authentication

The authentication protocol itself may authenticate the user. EAP-TLS is an example of such a protocol. Alternatively, the authentication protocol may rely on a separate authentication provider to authenticate the user. Two authentication providers are built into Microsoft® Windows® 2000: Windows 2000 domain authentication (accessed via Directory Services) and RADIUS (Remote Access Dial In User Service).

In the case where RADIUS is the authentication provider, the EAP DLL is installed on the RADIUS server rather than on the RAS server. The RAS server passes EAP packets directly from the client to the authentication protocol on the RADIUS server. The RAS server does not process any of the information in the EAP packets.


EAP Implementation Details

Remote Access Service (RAS) interacts with EAP implementations through the use of function calls that must be exported by the third-party EAP DLL. The following topics detail this interaction:

  • RAS Initialization of EAP
  • Authentication Protocol Initialization
  • RAS and Authentication Protocol Interaction
  • Completion of the Authentication Session


RAS Initialization of EAP

Upon initialization, RAS queries the registry for installed authentication protocols. RAS calls the exported function RasEapGetInfo for each authentication protocol. The RasEapGetInfo function receives a single parameter of type PPP_EAP_INFO. RAS uses the dwEapTypeId member of this structure to specify the authentication protocol. Note that a single DLL may support more than one protocol. If RasEapGetInfo returns any value other than NO_ERROR, RAS assumes that the authentication protocol is unavailable.

On return from RasEapGetInfo the PPP_EAP_INFO structure contains pointers to the functions RasEapInitialize, RasEapBegin, RasEapMakeMessage, and RasEapEnd in the EAP DLL. RAS uses these functions to interoperate with the authentication protocol. RAS immediately calls RasEapInitialize for each authentication protocol, to initialize it. When RAS shuts down it calls RasEapInitialize again, this time with the fInitialize parameter set to FALSE, indicating that the authentication protocol should shut itself down.


Authentication Protocol Initialization

When creating a phone-book entry for a particular connection, the user selects an authentication protocol to use for that connection. The selected authentication protocol may require configuration. If so, the Dial-Up Networking user interface (UI) displays a configuration UI by calling the RasEapInvokeConfigUI function. The Dial-Up Networking UI stores the configuration information returned by RasEapInvokeConfigUI in the phone-book entry. The setup program for the authentication protocol may also store default configuration information in the registry. For more information, see EAP Installation.

The configuration information stored in the phone-book entry should be generic to all users on the client computer. Information specific to a particular user or users should not be stored in the phone-book entry. The authentication protocol should obtain user-specific information via the identity function interface or interactive user-interface. The authentication protocol can store this information in the registry by passing it to RAS in the pEapOutput parameter of RasEapMakeMessage.

The configuration information should not be specific to the current machine; it should be portable from machine to machine.

When the client attempts to establish the connection, RAS obtains identity information for the user. If the RAS_EAP_VALUENAME_INVOKE_NAMEDLG value is present in the registry for this authentication protocol, and this value is set to zero, RAS calls RasEapGetIdentity. This function typically displays a user interface that allows the identity information to be of a type specific to the authentication protocol; for example, a certificate or numeric ID. If RAS_EAP_VALUENAME_INVOKE_NAMEDLG is not present, or is set to one, RAS displays the standard Windows NT/Windows 2000 user-name dialog.

Once RAS has obtained the identity information for the user, RAS calls the authentication protocol's implementation of RasEapBegin. This call allows the protocol to allocate and initialize a work buffer that RAS passes on subsequent calls to RasEapMakeMessage and RasEapEnd. In RasEapBegin, RAS also passes a PPP_EAP_INPUT structure that contains pointers to the configuration information for the connection, and the identity information for the user. RAS always passes in a value for the pszIdentity member of PPP_EAP_INPUT. However, the pszPassword member of PPP_EAP_INPUT may be NULL.

Within the PPP_EAP_INPUT structure, the fAuthenticator member indicates whether the authentication protocol is being invoked to be authenticated (on the client) or as the authenticator (on the server).

On the server, the bInitialID member of PPP_EAP_INPUT specifies the ID that the server should use for the first EAP packet. The server should increment this ID for subsequent packets.

Also on the server, the pUserAttributes pointer in PPP_EAP_INPUT points to an array of attributes of the RAS_AUTH_ATTRIBUTE_TYPE type. These are attributes for the user that were obtained from the client.

If the RasEapBegin call returns any value other than NO_ERROR, the session is disconnected. The returned error is logged (on the server), or displayed to the user (on the client).


RAS and Authentication Protocol Interaction During Authentication

The RasEapMakeMessage function controls the majority of the interaction between the authentication protocol and RAS. RasEapMakeMessage processes incoming EAP packets and creates EAP packets for transmission to the remote peer. It also processes events such as time outs and authentication completion.

If a message is received from the remote peer, RAS calls RasEapMakeMessage, passing a pointer to the received message in the pReceivePacket parameter.

If RAS calls RasEapMakeMessage with pReceivePacket set to NULL, RAS is either initiating the dialog with the authentication protocol, or requesting that the protocol resend the last packet. The authentication protocol should determine which action RAS is taking based on its state and from the message context.

On return from RasEapMakeMessage, the value of the Action member of the PPP_EAP_OUTPUT structure indicates what action, if any, RAS should take. The Action member takes values from the PPP_EAP_ACTION enumerated type.

If Action is EAPACTION_Send, EAPACTION_SendAndDone, EAPACTION_SendWithTimeout, or EAPACTION_SendWithTimeoutInteractive, RAS transmits the packet that is pointed to by the pSendPacket parameter to the remote peer.

If Action is EAPACTION_SendWithTimeout, or EAPACTION_SendWithTimeoutInteractive, the authentication protocol should set the dwIdExpected member of the PPP_EAP_OUTPUT structure to the identifier of the next packet that is expected from the remote peer. Regardless of whether the next packet received from the peer matches this value, RAS passes the packet to the authentication protocol in a subsequent call to RasEapMakeMessage. The authentication protocol may silently discard the packet by simply returning ERROR_PPP_INVALID_PACKET. If a packet with the expected identifier is not received within the configured time-out period, RAS calls RasEapMakeMessage. The call is made with the pReceivePacket parameter set to NULL, to indicate that the previous packet needs to be sent again.

The EAPACTION_SendWithTimeout value allows for a time out, after which time RAS assumes the link was lost, and disconnects the session.

The EAPACTION_SendWithTimeoutInteractive value allows an infinite amount of time out to occur. The authenticator should use this value when expecting user input on the client. This time out allows the user an unspecified amount of time to complete the required input.

If the Action member is EAPACTION_Done or EAPACTION_SendAndDone, RAS examines the dwAuthResultCode member of PPP_EAP_OUTPUT. If dwAuthResultCode is NO_ERROR, the authentication succeeded. If dwAuthResultCode is a value other than NO_ERROR, the authentication failed. The error code returned for the failure case should come from Raserror.h, Mprerror.h, or Winerror.h. Possible return codes include, but are not limited to, the following:

ERROR_NO_DIALIN_PERMISSION

ERROR_PASSWD_EXPIRED

ERROR_ACCT_DISABLED

ERROR_RESTRICTED_LOGON_HOURS

ERROR_AUTH_INTERNAL

In the case where Action is EAPACTION_Done or EAPACTION_SendAndDone, the pUserAttributes member should point to attributes that override attributes of the same type that were passed to the server in the call to RasEapBegin.

The authentication protocol can request that RAS invoke the current authentication provider by returning EAPACTION_Authenticate in the Action member in PPP_EAP_OUTPUT. In this case, the pUserAttributes pointer in PPP_EAP_OUTPUT should point only to attributes that were generated by the authentication protocol on the server. It need not include any of the attributes that were passed to the server in the call to RasEapBegin. When RAS responds to the EAPACTION_Authenticate action, pUserAttributes in PPP_EAP_INPUT, will point to all attributes generated during authentication. These attributes will also be returned to the authentication protocol on the client.

If the authentication protocol authenticates the user without relying on an authentication provider, there is no need for the protocol to ever set Action to EAPACTION_Authenticate. An example of this case is EAP-Transport Layer Security (TLS).

The EAP success packet is a non-acknowledged packet. Therefore, it may be lost and not resent by the server. If RAS on the client receives a Network Control Protocol (NCP) packet, RAS is programmed to proceed as though the authentication was successful, but the EAP success packet was lost. This is because the server has moved on to the NCP phase of PPP. Accordingly, RAS calls RasEapMakeMessage with the fSuccessPacketReceived member of the PPP_EAP_INPUT structure set to TRUE.

During the course of the authentication session, the authentication protocol may need to interact directly with the user on the client. The authentication protocol vendor can provide an interactive user interface for this purpose. The authentication protocol can request that RAS display the interactive UI by setting the fInvokeInteractiveUI, pUIContextData, and dwSizeOfUIContextData members in the PPP_EAP_OUTPUT structure. For more information on using an interactive UI, see Interactive User Interface.

The authentication protocol should display a user interface only through the mechanism described under Interactive User Interface. If the authentication protocol itself displays the user interface, the PPP thread blocks until the user interface is dismissed.

If during the authentication process, RasEapMakeMessage returns any value other than NO_ERROR or ERROR_PPP_INVALID_PACKET, the session is disconnected and the error is logged (on the server) or displayed to the user (on the client).


Completion of the Authentication Session

After the authentication session is completed, RAS calls the RasEapEnd function to allow the authentication protocol to deallocate its work buffer. This action is taken regardless of whether authentication was successful. Calling the RasEapEnd function guarantees that no further calls are made to the authentication protocol using that particular user or context without first calling RasEapBegin.


Configuration User Interface

Configuration user interfaces (UI) for authentication protocols are implemented differently depending on whether the UI is for configuring the authentication protocol on the client, or on the server. The following topics describe the process used to implement a configuration UI for the client and for the server:

  • Server-Side Configuration User Interface
  • Client-Side Configuration User Interface


Server-Side Configuration User Interface

Implement a configuration UI for the server by implementing the COM interface, IEAPProviderConfig. This COM interface derives from IUnknown and adds three methods: IEAPProviderConfig::Initialize, IEAPProviderConfig::ServerInvokeConfigUI, and IEAPProviderConfig::Uninitialize.

The UI should support remote administration. In other words, although the UI will configure the authentication protocol on the server, the UI itself may be running on a different computer. To support remote administration, separate the UI code from the code that actually performs the configuration. The configuration code resides on the server on which the authentication protocol runs.

Microsoft recommends using the Active Template Library (ATL) to implement IEAPProviderConfig. See the sample server-side configuration UI in the SDK samples directory for more details. The class identifier (CLSID) for the configuration UI object should be placed in the registry with a value name of RAS_EAP_VALUENAME_CONFIG_CLSID. For more information, see Authentication Protocol Registry Values.

When the user clicks the Configure button for an authentication protocol in the Properties dialog box for Routing and RAS, the system checks whether a RAS_EAP_VALUENAME_CONFIG_CLSID value for this authentication protocol exists in the registry. If so, COM instantiates the configuration UI object. If the system is unable to find RAS_EAP_VALUENAME_CONFIG_CLSID in the registry, and the system has access to Directory Services (DS) (Windows 2000 only), the system attempts to instantiate the object from the Class Store.

In the case where the user is connected to multiple machines simultaneously, multiple configuration UI objects are instantiated.


Client-Side Configuration User Interface

The vendor that implements the authentication protocol may also provide a configuration user interface (UI) for the protocol. The configuration UI may be implemented in the same DLL as the authentication protocol, or in a separate DLL. Also, the DLL that implements the configuration UI may support more than one authentication protocol. The path to the DLL for the configuration user interface is stored in the RAS_EAP_VALUENAME_CONFIGUI registry value, under the key for the authentication protocol. For more information about creating this registry value, see EAP Installation.

The DLL for the configuration user interface should export entry points for the following functions:

RasEapInvokeConfigUI

RasEapFreeMemory

When the user creates a phone-book entry for a particular RAS server in the Dial-Up Networking UI, the user is able to select the authentication protocol that RAS should use with that entry. If the authentication protocol is configurable, the Dial-Up Networking UI calls RasEapInvokeConfigUI to invoke the configuration UI. The Dial-Up Networking UI stores the configuration information returned by RasEapInvokeConfigUI in the phone-book entry

The configuration information stored in the phone-book entry should be generic to all users on the client computer. Information specific to a particular user or users should not be stored in the phone-book entry. The authentication protocol should obtain user-specific information by using the identity functions or interactive user-interface. The authentication protocol can store this information in the registry by passing it to RAS in the pEapOutput parameter of RasEapMakeMessage.

The configuration information should also not be specific to the current machine; it should be portable from machine to machine.

When RAS calls the RasEapBegin function for the authentication protocol, it passes a PPP_EAP_INPUT structure that contains a pointer to the configuration information. After RasEapBegin returns, RAS calls RasEapFreeMemory to free the memory occupied by the configuration information. Therefore, the authentication protocol should copy the configuration information into a private memory buffer during the call to RasEapBegin.

The vendor may add a value under the registry key for the authentication protocol that specifies default configuration information for the protocol. The vendor may also add a value that specifies whether the user is required to enter configuration information when they create a phone-book entry. For more information, see Authentication Protocol Registry Values.


Obtaining Identity Information

The vendor that implements the authentication protocol may also provide a function interface that obtains initial identifying information for the user requesting authentication. The vendor should implement the following functions:

RasEapGetIdentity

RasEapFreeMemory

These functions may be implemented in the same DLL as the authentication protocol, or in a separate DLL. Also, the DLL that implements the identity functions may support more than one authentication protocol. The path to the DLL for these functions is stored in the RAS_EAP_VALUENAME_IDENTITY registry value, under the key for the authentication protocol. For more information about creating this registry value, see EAP Installation.

The RasEapGetIdentity function typically displays a user interface (UI) to obtain identity information for the user. However, if the dwFlags parameter contains the RAS_EAP_FLAG_NON_INTERACTIVE flag, RasEapGetIdentity should not display a UI.

If RasEapGetIdentity does display a UI, the UI must support WM_COMMAND messages where the value of LOWORD(wParam) is equal to IDCANCEL.

The Remote Access Service (RAS) calls RasEapGetIdentity if the RAS_EAP_VALUENAME_INVOKE_NAMEDLG value that is in the registry for this EAP is set to zero. If RAS_EAP_VALUENAME_INVOKE_NAMEDLG is not present, or is present and is set to one, RAS displays the standard Windows NT/Windows 2000 user name dialog box.

In addition to RAS_EAP_VALUENAME_INVOKE_NAMEDLG, the EAP vendor may create a related value in the registry: RAS_EAP_VALUENAME_INVOKE_PWDDLG. If this value is present and is set to zero, RAS will not display the standard Windows NT/Windows 2000 password dialog. This value is useful when implementing a biometric method such as a fingerprint scan to authenticate the user. If both the RAS_EAP_VALUENAME_INVOKE_NAMEDLG and RAS_EAP_VALUENAME_INVOKE_PWDDLG values are zero, an identity UI could be used to obtain both the identity and biometric information. However, if only RAS_EAP_VALUENAME_INVOKE_PWDDLG is zero, RAS will not call RasEapGetIdentity. In this case, you could use the interactive user interface to obtain the biometric information.

For more information on these registry values, see Authentication Protocol Registry Values.

The information obtained by RasEapGetIdentity is passed to the authentication protocol during the call to RasEapBegin. The information is pointed to by the pszIdentity and pUserData members of the PPP_EAP_INPUT structure. To save this information in the registry on the client computer, the authentication protocol should return the information in the pEapOutput parameter of RasEapMakeMessage.

After the call to RasEapBegin, RAS calls RasEapFreeMemory to free the memory occupied by this data. Therefore, the authentication protocol should copy the information into a private memory buffer during the call to RasEapBegin.


Interactive User Interface

The vendor that implements the authentication protocol may also provide an interactive user interface (UI) for the protocol. The interactive UI allows the authentication protocol to obtain additional information from the user as needed during the course of the authentication session.

The interactive UI can be implemented in the same DLL as the authentication protocol, or in a separate DLL. Also, the DLL that implements the interactive UI can support more than one authentication protocol. The path to the DLL for the interactive UI is stored in the RAS_EAP_VALUENAME_INTERACTIVEUI registry value, under the key for the authentication protocol. For more information about creating this registry value, see EAP Installation.

The DLL for the interactive UI should export entry points for the following functions:

RasEapInvokeInteractiveUI

RasEapFreeMemory

The interactive user interface must support WM_COMMAND messages where LOWORD(wParam) equals IDCANCEL.

To display the interactive UI, the authentication protocol should set the fInvokeInteractiveUI member of the PPP_EAP_OUTPUT structure to TRUE. The authentication protocol may optionally set the pUIContextData and dwSizeOfUIContextData members as well. RAS uses the values of these members to pass context data to the interactive UI. The authentication protocol returns this PPP_EAP_OUTPUT structure as a parameter in the RasEapMakeMessage function.

RAS invokes the interactive UI by calling RasEapInvokeInteractiveUI. RAS passes the authentication protocol a pointer to the data returned by the interactive UI in the subsequent call to RasEapMakeMessage. The pointer is passed as a member of a PPP_EAP_INPUT structure. After RasEapMakeMessage returns, RAS calls RasEapFreeMemory to free the memory occupied by the information. Therefore, the authentication protocol should copy the information into a private memory buffer during the call to RasEapMakeMessage.


Multilink and Callback Connections

For the first link in a multilink connection, RAS sets the RAS_EAP_FLAG_FIRST_LINK flag in the fFlags member of the PPP_EAP_INPUT structure. The authentication protocol can use the presence of this flag to determine whether to present a user interface specifically for the first link of a multilink connection.

If the connection is configured so that the server calls back the client computer, the RAS_EAP_FLAG_FIRST_LINK flag will not be set on the callback.

If the authentication protocol sets the fSaveConnectionData member of PPP_EAP_OUTPUT to TRUE, subsequent links in the multilink connection will receive the new connection-specific data. In the case of user-specific data, however, the authentication protocol continues to get the original user-specific data even if it sets the fSaveUserData member of PPP_EAP_OUTPUT to TRUE.

The authentication protocol may use an interactive user interface to collect data for a particular link of a multilink connection. In this case, RAS makes the resulting data available to the authentication protocol during subsequent links. However, this data is never saved to persistent storage.


Extensible Authentication Protocol Reference

This section describes the reference elements that are used to implement the Extensible Authentication Protocol (EAP). Among these reference elements are functions that are used to implement authentication protocols, authentication providers, and accounting providers. This section also includes the structures and enumerated types these functions use.

This documentation describes the following topics:

  • EAP Functions
  • EAP Structures
  • EAP Enumerated Types
  • Extensible Authentication Protocol COM Interface


EAP Functions

The following functions are implemented for authentication protocols and authentication providers:

RasEapBegin

RasEapEnd

RasEapFreeMemory

RasEapGetIdentity

RasEapGetInfo

RasEapInitialize

RasEapInvokeConfigUI

RasEapInvokeInteractiveUI

RasEapMakeMessage


RasEapBegin

The Connection Manager calls the RasEapBegin function to initiate an authentication session.

DWORD ( *RasEapBegin )(
  VOID * * ppWorkBuffer,           // buffer used in subsequent
                                   // calls to protocol
  PPP_EAP_INPUT * pPppEapInput     // initialization information
);

Parameters

ppWorkBuffer
[out] Pointer to a pointer that, points to a work buffer. This buffer is opaque to RAS; the contents of the buffer are used only by the authentication protocol. The Connection Manager passes a pointer to this buffer to the authentication protocol in subsequent calls to RasEapMakeMessage.
pPppEapInput
[in] Pointer to a PPP_EAP_INPUT structure that specifies initialization information for the authentication session.

Return Values

If the function succeeds, the return value is NO_ERROR.

If the function fails, the return value should be an appropriate error code from Winerror.h, Raserror.h, or Mprerror.h.

Remarks

The RasEapBegin function is not part of the RRAS API; it is implemented in the EAP DLL. When the Connection Manager calls the RasEapGetInfo function, it receives a PPP_EAP_INFO structure for the authentication protocol. This structure contains a pointer to the RasEapBegin function.

The memory for the work buffer (pointed to by *ppWorkBuffer) is allocated by the authentication protocol. The authentication protocol should free this memory in its implementation of RasEapEnd.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Functions, RasEapEnd, RasEapGetInfo, RasEapMakeMessage, PPP_EAP_INFO, PPP_EAP_INPUT


RasEapEnd

The Connection Manager calls the RasEapEnd function to end an authentication session. RAS will call RasEapEnd regardless of whether the session completed successfully.

DWORD ( *RasEapEnd ) (
  VOID * pWorkBuffer    // work buffer to free
);

Parameters

pWorkBuffer
[in] Pointer to the work buffer to free.

Return Values

If the function succeeds, the return value is NO_ERROR.

If the function fails, the return value should be an appropriate error code from Winerror.h, Raserror.h, or Mprerror.h. If RasEapEnd returns an error code, RAS terminates the authentication session.

Remarks

The RasEapEnd function is not part of the RRAS API; it is implemented in the EAP DLL. When the Connection Manager calls the RasEapGetInfo function, it receives a PPP_EAP_INFO structure for the authentication protocol. This structure contains a pointer to the RasEapEnd function.

Provided that RasEapBegin returned successfully, the Connection manager calls the RasEapEnd function when authentication has completed.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Functions, RasEapBegin, RasEapGetInfo, PPP_EAP_INFO, PPP_EAP_INPUT


RasEapFreeMemory

The Connection Manager calls RasEapFreeMemory to free memory buffers returned by RasEapInvokeConfigUI, RasEapGetIdentity, and RasEapInvokeInteractiveUI.

DWORD RasEapFreeMemory(
  BYTE * pMemory    // pointer to the memory to free
);

Parameters

pMemory
[in] Pointer to the memory to free.

Return Values

If the function succeeds, the return value is NO_ERROR.

If the function fails, the return value should be an appropriate error code from Winerror.h, Raserror.h, or Mprerror.h.

Remarks

An authentication protocol may implement its various user interfaces in different DLLs. In such a case, each DLL must implement the RasEapFreeMemory function.

It is also possible that a single DLL may implement multiple user interfaces. For example, a single DLL may implement both the configuration and identity user interface for an authentication protocol. Another example would be a DLL that implements two configuration user interfaces, each to support a different authentication protocol. In these cases, the DLL must implement a single version of RasEapFreeMemory that can free memory returned from any of the user interfaces implemented in the DLL.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Functions, RasEapInvokeConfigUI, RasEapGetIdentity, RasEapInvokeInteractiveUI


RasEapGetIdentity

The RAS Connection Manager calls the RasEapGetIdentity function to obtain identity information for the user requesting authentication.

DWORD RasEapGetIdentity(
  DWORD dwEapTypeId,              // identifies the protocol
  HWND  hwndParent,               // handle to parent window
  DWORD dwFlags,                  // flags that qualify
                                  // authentication process
  const WCHAR *  pwszPhonebook,  // path to phone book to use
  const WCHAR *  pwszEntry,      // name of entry in phone book
  BYTE * pConnectionDataIn,       // pointer to current
                                  // connection data
  DWORD  dwSizeOfConnectionDataIn, // size of current
                                  // connection data
  BYTE * pUserDataIn,              // pointer to current
                                  // user data from registry
  DWORD  dwSizeOfUserDataIn,      // size of current user data
  BYTE * * ppUserDataOut,          // new user data
  DWORD *  pdwSizeOfUserDataOut,  // size of new user data
  WCHAR *  ppwszIdentity          // identity of user
);

Parameters

dwEapTypeId
[in] Specifies the authentication protocol for which to invoke the identity user interface.
hwndParent
[in] Handle to the parent window for the user interface dialog. If the dwFlags parameter contains the RAS_EAP_FLAG_NON_INTERACTIVE flag, then hwndParent is NULL.
dwFlags
[in] Specifies zero or more of the following flags that qualify the authentication process.
Flag | Description
RAS_EAP_FLAG_ROUTER | Specifies that the computer that is dialing in is a router. The absence of this flag indicates that the computer dialing in is a RAS client.
RAS_EAP_FLAG_NON_INTERACTIVE | Specifies that the authentication protocol should not bring up a user-interface. If the authentication protocol is not able to determine the identity from the data supplied, it should return an error. If this flag is specified, the hwndParent parameter will be NULL.
RAS_EAP_FLAG_LOGON | Specifies that the user data is obtained when logging onto the local system, that is from Winlogon.exe.
RAS_EAP_FLAG_PREVIEW | Specifies that the user should be prompted for identity information before dialing.
RAS_EAP_FLAG_FIRST_LINK | Indicates that this connection is the first link in a multilink connection. See Multilink and Callback Connections for more information.

pwszPhonebook
[in] Pointer to a Unicode string that specifies the full path of the phone-book (PBK) file. If this parameter is NULL, the function uses the system phone book.
pwszEntry
[in] Pointer to a Unicode string that specifies an existing entry name.
pConnectionDataIn
[in] Pointer to the connection-specific data currently stored in the phone-book entry.
dwSizeOfConnectionDataIn
[in] Specifies the size of the connection-specific data currently stored in the phone-book entry.
pUserDataIn
[in] Pointer to the user-specific data currently stored for this user in the registry.
dwSizeOfUserDataIn
[in] Specifies the size of the user-specific data currently stored for this user in the registry.
ppUserDataOut
[out] Pointer to a pointer that, on successful return, points to the identity data for the user. This data will be passed to the authentication protocol in the pUserData member of PPP_EAP_INPUT during the call to RasEapBegin.

The authentication protocol should allocate the memory buffer for the identity data. RAS will free this memory by calling RasEapFreeMemory.

pdwSizeOfUserDataOut
[out] Pointer to a DWORD variable that receives the size of the data pointed to by the ppUserDataOut parameter.
ppwszIdentity
[out] Pointer to a pointer that, on successful return, points to a Unicode string that identifies the user requesting authentication. This string will be passed to the authentication protocol in the pszIdentity member of PPP_EAP_INPUT during the call to RasEapBegin.

Return Values

If the function succeeds, the return value is NO_ERROR.

If the function was not able to allocate memory for the user data, the return value should be ERROR_NOT_ENOUGH_MEMORY.

If the function is called with the RAS_EAP_FLAG_NON_INTERACTIVE flag, but must invoke a user interface to determine the user's identity, the function should return ERROR_INTERACTIVE_MODE.

If the function fails in some other way, the return value should be an appropriate error code from Winerror.h, Raserror.h, or Mprerror.h.

Remarks

The DLL that implements RasEapGetIdentity and RasEapFreeMemory may support more than one authentication protocol. The dwEapTypeId parameter specifies for which protocol to invoke the identity user interface.

The authentication protocol receives the data returned from RasEapGetIdentity in the pUserData member of PPP_EAP_INPUT during RasEapBegin. To store the data for this user in the registry, the authentication protocol should set the pUserData member of PPP_EAP_OUTPUT to point to the data, and the fSaveUserData member of PPP_EAP_OUTPUT to TRUE.

This function is called by the RAS function, RasGetEapUserIdentity.

If RasEapGetIdentity displays a user interface, the user interface must support WM_COMMAND messages where LOWORD(wParam) equals IDCANCEL.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Functions, Obtaining Identity Information, RasEapFreeMemory, RasEapMakeMessage, RasGetEapUserIdentity, PPP_EAP_INPUT


RasEapGetInfo

The Connection Manager calls RasEapGetInfo to obtain a set of function pointers for a specified authentication protocol.

DWORD RasEapGetInfo(
  DWORD dwEapTypeId           // identifies the protocol
  PPP_EAP_INFO * pEapInfo     // pointer to information for a particular EAP
);

Parameters

dwEapTypeId
[in] Specifies the authentication protocol for which to obtain information.
pEapInfo
[out] Pointer to a PPP_EAP_INFO structure. The structure receives members that RAS sets to identify the structure version and the authentication protocol for which function pointers are requested. For more information, see PPP_EAP_INFO.

Return Values

If the function succeeds, the return value is NO_ERROR.

If the function fails, the return value should be an appropriate error code from Winerror.h, Raserror.h, or Mprerror.h.

Remarks

The DLL that implements RasEapGetInfo may support more than one authentication protocol. The dwEapTypeId parameter specifies for which authentication protocol to obtain information.

Implementations of EAP must export the RasEapGetInfo function, since RAS uses RasEapGetInfo to obtain pointers to the other authentication protocol functions.

Upon initialization, the Connection Manager calls RasEapGetInfo for each EAP DLL installed in the registry subkey, as explained in the EAP Overview.

If the function returns any value other than NO_ERROR, RAS considers the authentication protocol to be non-functional. RAS posts an error to the Microsoft® Windows NT®/Windows® 2000 Event Log indicating that this protocol did not start correctly and therefore is not available.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Functions, EAP (Extensible Authentication Protocol) Overview, PPP_EAP_INFO


RasEapInitialize

The RAS Connection Manager calls the RasEapInitialize function to initialize or deinitialize the authentication protocol.

DWORD RasEapInitialize(
  BOOL fInitialize    // TRUE to init, FALSE to deinit
);

Parameters

fInitialize
[in] Specifies whether the authentication protocol should initialize or deinitialize. This parameter is TRUE if the protocol initializes and FALSE if the protocol does not initialize.

Return Values

If the function succeeds, the return value is NO_ERROR.

If the function fails, the return value should be an appropriate error code from Winerror.h, Raserror.h, or Mprerror.h.

Remarks

The RasEapInitialize function is not part of the RRAS API; it is implemented in the EAP DLL. When the Connection Manager calls the RasEapGetInfo function, it receives a PPP_EAP_INFO structure for the authentication protocol. This structure contains a pointer to the RasEapInitialize function.

The authentication protocol may set the RasEapInitialize member in PPP_EAP_INFO to NULL. A NULL value indicates that the authentication protocol does not require initialization or deinitialization. Therefore, RAS need not call this function.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Functions, PPP_EAP_INFO, RasEapBegin, RasEapGetInfo


RasEapInvokeConfigUI

The Connection Manager calls the RasEapInvokeConfigUII function to display a dialog to obtain configuration information from the user. RAS calls RasEapInvokeConfigUI when a new phone-book entry is created or an existing phone-book entry is edited, provided that the authentication protocol for the entry provides a configuration user interface.

DWORD RasEapInvokeConfigUI(
  DWORD dwEapTypeId,                    // identifies the protocol
  HWND hwndParent,                      // handle to parent window
  DWORD dwFlags,                        // indicates whether caller is
                                        // router or RAS client
  BYTE * pConnectionDataIn,             // current connection data
  DWORD dwSizeOfConnectionDataIn,       // size of current connection data
  BYTE * * ppConnectionDataOut,         // new connection data
  DWORD *  pdwSizeOfConnectionDataOut,  // size of new connection data
);

Parameters

dwEapTypeId
[in] Specifies the authentication protocol for which to invoke the configuration UI.
hwndParent
[in] Handle to the parent window for the UI dialog.
dwFlags
[in] Specifies whether the computer that is dialing in is a router or a RAS client. If the computer is a router, this parameter should be set to:

RAS_EAP_FLAG_ROUTER

Otherwise, this parameter should be zero.

pConnectionDataIn
[in] Pointer to the connection data currently stored in the phone-book entry. If the phone-book entry does not contain any data, this parameter is NULL.
dwSizeOfConnectionDataIn
[in] Specifies the size of the connection data currently stored in the phone-book entry. If the phone-book entry for this connection does not contain any data, this parameter will be zero.
ppConnectionDataOut
[out] Pointer to a pointer that, on successful return, points to the new connection data to store in the phone-book entry. None of this data should be specific to the current machine; phone-book entries should be portable from machine to machine.
pdwSizeOfConnectionDataOut
[out] Pointer to a DWORD that receives the size of the new connection data to store in the phone-book entry.

Return Values

If the function succeeds, the return value is NO_ERROR.

If the function was not able to allocate memory for the configuration data, the return value should be ERROR_NOT_ENOUGH_MEMORY.

If the function fails in some other way, the return value should be an appropriate error code from Winerror.h, Raserror.h, or Mprerror.h.

Remarks

The DLL that implements RasEapInvokeConfigUI and RasEapFreeMemory may support more than one authentication protocol. The dwEapTypeId parameter specifies for which protocol to invoke the configuration UI.

RAS stores the connection data returned by RasEapInvokeConfigUI in the phone-book entry for the connection on the client computer.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Functions, Client-Side Configuration User Interface,

RasEapFreeMemory,

RasEapGetIdentity, RasEapInvokeInteractiveUI


RasEapInvokeInteractiveUI

The RAS Connection Manager calls the RasEapInvokeInteractiveUI function to display a dialog to obtain authentication data from the user.

DWORD RasEapInvokeInteractiveUI(
  DWORD dwEapTypeId,                 // identifies the protocol
  HWND hwndParent,                   // handle to parent window
  BYTE * pUIContextData,             // pointer to context data
  DWORD dwSizeofUIContextData,       // size of context data
  BYTE * * ppDataFromInteractiveUI,       // pointer to data
                                          // returned from UI
  DWORD *  pdwSizeOfDataFromInteractiveUI // size of data returned
                                          // from UI.
);

Parameters

dwEapTypeId
[in] Specifies the authentication protocol for which to invoke the interactive UI.
hwndParent
[in] Handle to the parent window for the dialog.
pUIContextData
[in] Pointer to context data for the interactive UI. The authentication protocol provides a pointer to this data as a member of the PPP_EAP_OUTPUT structure. The RAS Connection Manager receives the PPP_EAP_OUTPUT structure as an output parameter from the RasEapMakeMessage function.
dwSizeofUIContextData
[in] Specifies the size of the context data. The authentication protocol provides the size as a member of the PPP_EAP_OUTPUT structure. The RAS Connection Manager receives the PPP_EAP_OUTPUT structure as an output parameter from the RasEapMakeMessage function.
ppDataFromInteractiveUI
[out[ Pointer to a pointer variable. On successful return, this pointer variable will point to a memory buffer that contains the data obtained by the interactive UI. The interactive UI allocates this memory. RAS passes this data back to the authentication protocol in the PPP_EAP_INPUT structure, then RAS frees this memory by calling RasEapFreeMemory.

If the interactive UI does not obtain any user-specific data, the pointer that ppUserData points to should be set to NULL.

pdwSizeOfDataFromInteractiveUI
[out] Pointer to a DWORD variable that receives the size of the data returned from the interactive UI. If the interactive UI does not obtain any user-specific data, the DWORD variable should be set to zero.

Return Values

If the function succeeds, the return value is NO_ERROR. Check the ppDataFromInteractiveUI and lpdwSizeOfDataFromInteractiveUI parameters to determine if the function returned data from the interactive UI.

If the function was not able to allocate memory for the data, the return value should be ERROR_NOT_ENOUGH_MEMORY.

If the function fails in some other way, the return value should be an appropriate error code from Winerror.h, Raserror.h, or Mprerror.h.

Remarks

The DLL that implements the RasEapInvokeInteractiveUI and RasEapFreeMemory functions may support more than one authentication protocol. The dwEapTypeId parameter specifies the authentication protocol for which to invoke the interactive UI.

A pointer to the data returned from the interactive UI is passed back to the authentication protocol in the pDataFromInteractiveUI member of PPP_EAP_INPUT structure. The PPP_EAP_INPUT structure is passed as a parameter to the RasEapMakeMessage function.

The interactive user interface must support WM_COMMAND messages where LOWORD(wParam) equals IDCANCEL.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Functions, Interactive User Interface, RasEapFreeMemory, RasEapInvokeConfigUI, RasEapGetIdentity, RasEapMakeMessage, PPP_EAP_INPUT, PPP_EAP_OUTPUT


RasEapMakeMessage

The RasEapMakeMessage function is the framework within which incoming and outgoing EAP packets, time outs, and other events such as authentication completion are processed for an EAP. RAS calls the RasEapMakeMessage function every time there is an incoming or outgoing packet.

DWORD ( * RasEapMakeMessage ) (
  VOID * pWorkBuf,                  // pointer to the workbuffer for this
                                    // authentication sesssion
  PPP_EAP_PACKET * pReceivePacket,  // pointer to incoming packet
  PPP_EAP_PACKET * pSendPacket,     // pointer to packet to transmit
  DWORD cbSendPacket,               // max size of packet to transmit
  PPP_EAP_OUTPUT * pEapOutput,      // info/requests from EAP to RAS
  PPP_EAP_INPUT * pEapInput         // info/requests from RAS to EAP
);

Parameters

pWorkBuf
[in] Pointer to the work buffer. The authentication protocol provides RAS with a pointer to this buffer via the RasEapBegin function.
pReceivePacket
[in] Pointer to a PPP_EAP_PACKET structure that contains a received packet. A pReceivePacket value of NULL indicates either that RAS is initiating the dialog with the authentication protocol, or that a time out has occurred and the authentication protocol should resend the last packet. The authentication protocol must determine, based on context, which of these two cases is true.
pSendPacket
[out] Pointer to a PPP_EAP_PACKET structure. The authentication protocol can use this structure to specify a packet to send.
cbSendPacket
[in] Specifies the size, in bytes, of the buffer pointed to by pSendPacket.
pEapOutput
[out] Pointer to a PPP_EAP_OUTPUT structure.
pEapInput
[in] Pointer to a PPP_EAP_INPUT structure. This parameter may be NULL.

Return Values

If the function succeeds, the return value is NO_ERROR.

If the function fails, the return value should be an appropriate error code from Winerror.h, Raserror.h, or Mprerror.h. Any error except for ERROR_PPP_INVALID_PACKET, terminates the authentication session. For more information on the ERROR_PPP_INVALID_PACKET return code, see EAP Implementation Details.

Remarks

The RasEapMakeMessage function is not part of the RRAS API; it is implemented in the EAP DLL. When the Connection Manager calls the RasEapGetInfo function, it receives a PPP_EAP_INFO structure for the authentication protocol. This structure contains a pointer to the RasEapMakeMessage function.

RAS allocates the buffers pointed to by pReceivePacket, pSendPacket, pEapOutput, and pEapInput. The authentication protocol does not allocate any of these buffers.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Functions, RasEapGetInfo, PPP_EAP_INFO, PPP_EAP_INPUT, PPP_EAP_OUTPUT, PPP_EAP_PACKET


EAP Structures

Vendors should use the following structure types for authentication protocols and authentication providers:

PPP_EAP_INFO

PPP_EAP_INPUT

PPP_EAP_OUTPUT

PPP_EAP_PACKET

RAS_AUTH_ATTRIBUTE


PPP_EAP_INFO

The PPP_EAP_INFO structure provides information to the Connection Manager about the authentication protocol, including pointers to functions located in the EAP DLL.

typedef struct _PPP_EAP_INFO {
  DWORD dwSizeInBytes;  // size of struct identifies version
  DWORD dwEapTypeId;    // identifies the authentication protocol
  DWORD ( * RasEapInitialize) (
      BOOL               fInitialize
  );
  DWORD ( * RasEapBegin ) (
      VOID * *           ppWorkBuffer,
      PPP_EAP_INPUT *    pPppEapInput
  );
  DWORD ( * RasEapEnd ) (
      VOID *             pWorkBuffer
  );
  DWORD ( * RasEapMakeMessage ) (
      VOID*              pWorkBuf,
      PPP_EAP_PACKET*    pReceivePacket,
      PPP_EAP_PACKET*    pSendPacket,
      DWORD              cbSendPacket,
      PPP_EAP_OUTPUT*    pEapOutput,
      PPP_EAP_INPUT*     pEapInput
  );
} PPP_EAP_INFO, *PPPP_EAP_INFO;

Members

dwSizeInBytes
Specifies the size of the PPP_EAP_INFO structure. RAS passes in this value to the EAP DLL. The DLL uses this value to determine which version of the PPP_EAP_INFO structure RAS is using.
dwEapTypeId
Specifies a particular authentication protocol. This identifier must be unique throughout industry-wide implementation of EAP (see IETF Internet Draft 1310). The implementer of an authentication protocol must obtain this identifier from the Internet Assigned Numbers Authority (IANA).
( * RasEapInitialize )
Pointer to the RasEapInitialize function for the authentication protocol. The authentication protocol sets the value of this member. The authentication protocol may set this member to NULL, in which case the protocol does not require RAS to call this function.
( * RasEapBegin )
Pointer to the RasEapBegin function for the requested authentication protocol. The authentication protocol sets the value of this member. This member may be NULL, in which case, the authentication protocol does not require any initialization. If this member is NULL, RAS ignores the RasEapEnd member.
( * RasEapEnd )
Pointer to the RasEapEnd function for the authentication protocol. The authentication protocol sets the value of this member.
( * RasEapMakeMessage )
Pointer to the RasEapMakeMessage for the requested authentication protocol. The authentication protocol sets the value of this member.

Remarks

A given EAP DLL may implement more than one authentication protocol. Use the dwEapTypeId member to specify for which protocol to retrieve information.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Structures, RasEapBegin, RasEapEnd, RasEapGetInfo, RasEapMakeMessage.


PPP_EAP_INPUT

The PPP_EAP_INPUT structure is used in the interaction between the RAS Connection Manager Service PPP implementation and the EAP to provide user information, and to facilitate the use of authentication providers such as Windows 2000 domain authentication or RADIUS.

typedef struct _PPP_EAP_INPUT {
  DWORD     dwSizeInBytes   // size of this structure
  DWORD     fFlags          // flags that qualify the
                            // authentication process
  BOOL      fAuthenticator; // act as authenticator or authenticatee
  WCHAR *   pwszIdentity;   // users's identity
  WCHAR *   pwszPassword;   // user's account password.
  BYTE      bInitialId;     // ID of initial EAP packet
  RAS_AUTH_ATTRIBUTE * pUserAttributes;
  BOOL      fAuthenticationComplete;
  DWORD     dwAuthResultCode;
  HANDLE   hTokenImpersonateUser    // handle to impersonate
                                    // user being authenticated
  DWORD    fSuccessPacketReceived   // true if success indicated
                                    // by NCP packet
  DWORD    fDataReceivedFromInteractiveUI  // true if user exits
                                           // from interactive UI
  PBYTE    pDataFromInteractiveUI          // pointer to data from
                                           // the interactive UI
  DWORD    dwSizeOfDataFromInteractiveUI   // size of data from
                                           // the interactive UI
  PBYTE    pConnectionData                 // pointer to connection-
                                           // specific data from
                                           // config UI
  DWORD    dwSizeOfConnectionData          // size of connection-
                                           // specific data from
                                           // config UI
  PBYTE    pUserData                       // pointer to user data
                                           // from identity UI
  DWORD    dwSizeOfUserData                // size of user data
                                           // from identity UI
  HANDLE   hReserved                       // reserved
} PPP_EAP_INPUT, * PPPP_EAP_INPUT;

Members

dwSizeInBytes
Specifies the size in bytes of the PPP_EAP_INPUT structure. The value of this member can be used to distinguish between current and future versions of this structure.
fFlags
Specifies zero or more of the following flags that qualify the authentication process.
Flag | Description
RAS_EAP_FLAG_ROUTER | Specifies whether the computer dialing in is a router or a RAS client. If the computer is a router, this parameter should be set.
RAS_EAP_FLAG_NON_INTERACTIVE | Specifies that the authentication protocol should not bring up a user-interface. If the authentication protocol is not able to determine the identity from the data supplied, it should return an error.
RAS_EAP_FLAG_LOGON | Specifies that the user data from obtained from Winlogon.
RAS_EAP_FLAG_FIRST_LINK | Indicates that this connection is the first link in a multilink connection. See Multilink and Callback Connections for more information.

fAuthenticator
Specifies whether the authentication protocol is operating on the server or client. A value of TRUE indicates that the authentication protocol is operating on the server as the authenticator. A value of FALSE indicates that the authentication protocol is operating on the client as the process to be authenticated.
pwszIdentity
Pointer to an Unicode that identifies the user requesting authentication. This string is of the form domain\user or machine\user.

If the authentication protocol is able to derive the user's identity from an additional source, for example a certificate, it should verify that the identity so derived matched the value of pszIdentity.

pwszPassword
Pointer to a Unicode string that contains the user's account password. Available only if fAuthenticator is FALSE. This member may be NULL.
bInitialId
Specifies the identifier of the initial EAP packet sent by the DLL. This value is incremented by one for each subsequent request packet.
pUserAttributes
Pointer to an array of RAS_AUTH_ATTRIBUTE structures. The array is terminated by a structure with an raaType member that has a value of raatMinimum (see RAS_AUTH_ATTRIBUTE_TYPE) During the RasEapBegin call, this array contains attributes that describe the currently dialed-in user. When the fAuthenticationComplete member is TRUE, this array may contain attributes returned by the authentication provider.
fAuthenticationComplete
Specifies a Boolean value that indicates whether the authentication provider has authenticated the user. A value of TRUE indicates authentication completion. Check the dwAuthResultCode field to determine if the authentication was successful. Ignore this field if the authentication protocol is not using an authentication provider.
dwAuthResultCode
Specifies the result of the authentication provider's authentication process. Successful authentication results in NO_ERROR. Authentication failure codes for dwAuthResultCode must come only from Winerror.h, Raserror.h or Mprerror.h. Ignore this field if the authentication protocol is not using an authentication provider.
hTokenImpersonateUser
Handle to an impersonation token for the user requesting authentication. This member is valid only on the client side. For more information on impersonation tokens, see Access Tokens.
fSuccessPacketReceived
Specifies that authentication was successful. RAS sets this member to TRUE if the client receives an Network Control Protocol (NCP) packet even though the client has not yet received an EAP success packet. A value of FALSE indicates that no NCP packet has been received.

The EAP success packet is a non-acknowledged packet. Therefore, it may be lost and not resent by the server. In this situation, the receipt of an NCP packet indicates that authentication was successful, since the server has moved on to the NCP phase of PPP.

Examine this member only on the client side.

fDataReceivedFromInteractiveUI
Specifies whether information is available from the interactive user interface. Default is FALSE. RAS sets this member to TRUE whenever the user exits from the authentication protocol's interactive user interface.
pDataFromInteractiveUI
Pointer to data received from the authentication protocol's interactive user interface. This pointer is non-NULL if the fDataReceivedFromInteractiveUI member is TRUE and the interactive user interface did, in fact, return data. Otherwise, this pointer is NULL.

If non-NULL, the authentication protocol should make a copy of the data in its own memory space. RAS frees the memory occupied by this data on return from the call in which the PPP_EAP_INPUT structure was passed. To free the memory, RAS calls the RasEapFreeMemory function.

dwSizeOfDataFromInteractiveUI
Specifies the size, in bytes, of the data pointed to by pDataFromInteractiveUI. If no data is returned from the interactive user interface, this member is zero.
pConnectionData
Pointer to connection data received from the authentication protocol's configuration user interface. This data is available only when the PPP_EAP_INPUT structure is passed in RasEapBegin. It is not available in calls to RasEapMakeMessage.

The authentication protocol should make a copy of this data in its own memory space. RAS frees the memory occupied by this data on return from the call in which the PPP_EAP_INPUT structure was passed. To free the memory, RAS calls the RasEapFreeMemory function.

If the authentication protocol's configuration user interface does not return any data, this member is NULL.

dwSizeOfConnectionData
Specifies the size in bytes of the data pointed to by pConnectionData. If pConnectionData is NULL, this member is zero.
pUserData
Pointer to user data received from the authentication protocol's RasEapGetIdentity function on the client computer. If the authentication protocol does not implement RasEapGetIdentity, this member points to data from the registry for this user.

This data isavailable only when the PPP_EAP_INPUT structure is passed in RasEapBegin. It is not available in calls to RasEapMakeMessage.

The authentication protocol should make a copy of this data in its own memory space. RAS frees the memory occupied by this data on return from the call in which the PPP_EAP_INPUT structure was passed.

If the RasEapGetIdentity function is not implemented or did not return any data, and no data exists for the user in the registry, this member is NULL.

dwSizeOfUserData
Specifies the size, in bytes, of the data pointed to by pUserData. If pUserData is NULL, this member is zero.
hReserved
This member is reserved.

Remarks

The PPP_EAP_INPUT structure is passed by RAS to the authentication protocol in calls to RasEapBegin and RasEapMakeMessage.

The pszIdentity and pszPassword members of the PPP_EAP_INPUT structure are used by the RasEapBegin function to obtain user information. The pszPassword member is non-NULL only if the fAuthenticator member is FALSE, that is, the authentication protocol is running on the client computer.

If the authentication protocol is using an authentication provider, such as Radius or Windows 2000 domain authentication, the following members are used to interface with the authentication provider:

pUserAttributes

fAuthenticationComplete

dwAuthResultCode

Note that the array of RAS_AUTH_ATTRIBUTE structures is passed only if fAuthenticator is TRUE. This array contains current session information such as port identifier and local IP address.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Structures, RasEapBegin, RasEapGetIdentity, RasEapFreeMemory, RasEapMakeMessage, RAS_AUTH_ATTRIBUTE


PPP_EAP_OUTPUT

The authentication protocol uses the PPP_EAP_OUTPUT structure to communicate requests and status information to the Connection Manager on return from calls to RasEapMakeMessage.

typedef struct _PPP_EAP_OUTPUT {
  PPP_EAP_ACTION       Action;                // action that RAS
                                              // should take
  DWORD                dwAuthResultCode;      // result of
                                              // authentication
  RAS_AUTH_ATTRIBUTE * pUserAttributes;       // array of attributes
                                              // structures
  BOOL                 fInvokeInteractiveUI;  // causes RAS
                                              // to invoke
                                              // interactive UI
  PBYTE                pUIContextData;        // data to send to
                                              // interactive UI
  DWORD                dwSizeOfUIContextData; // size of data
  BOOL              fSaveConnectionData;
  PBYTE             pConnectionData;
  DWORD             dwSizeOfConnectionData;
  BOOL              fSaveUserData;
  PBYTE             pUserData;           // pointer to the user
                                         // identity info
  DWORD             dwSizeofUserData;    // size of the user
                                         // identity info
} PPP_EAP_OUTPUT, *PPPP_EAP_OUTPUT;

Members

Action
Specifies a PPP_EAP_ACTION value. The Connection Manager carries out this action on behalf of the authentication protocol.
dwAuthResultCode
Specifies whether authentication was successful. Any non-zero value for dwAuthResultCode indicates failure. The failure code must come from Winerror.h, Raserror.h or Mprerror.h. This member is valid only if the Action member has a value of EAPACTION_Done or EAPACTION_SendAndDone.
pUserAttributes
Pointer to an optional array of RAS_AUTH_ATTRIBUTE structures. The array is terminated by a structure with an raaType member that has a value of raatMinimum (see RAS_AUTH_ATTRIBUTE_TYPE).

This member should be set on the authenticator side when Action is EAPACTION_Authenticate, or when Action is EAPACTION_Done or EAPACTION_SendAndDone. and dwAuthResultCode is zero.

When Action is EAPACTION_Authenticate, the array may contain additional attributes necessary to authenticate the user, e.g. the user-password. If the authentication protocol passes in only the user name, RAS does not invoke the authentication provider to authenticate the user, Instead, RAS just passes back the current attributes for the user.

When Action is EAPACTION_Done or EAPACTION_SendAndDone, and dwAuthResultCode is zero, the array may contain additional attributes to assign to the user. These attributes overwrite any attributes of the same type returned by the authentication provider.

The authentication protocol frees this memory in its RasEapEnd function.

fInvokeInteractiveUI
Specifies whether RAS should invoke the authentication protocol's interactive UI. If the authentication protocol sets this member to TRUE, RAS invokes the interactive UI, by calling the RasEapInvokeInteractiveUI function provided by the authentication protocol.
pUIContextData
Pointer to context data that RAS should pass in the call to RasEapInvokeInteractiveUI. The authentication protocol should free this memory in its implementation of RasEapEnd.
dwSizeOfUIContextData
Specifies the size of the context data that RAS should pass in the call to RasEapInvokeInteractiveUI.
fSaveConnectionData
Specifies whether RAS should save the information pointed to by the pConnectionData member. If fSaveConnectionData is TRUE, RAS will save the data in the phone book. Only valid for the process that is being authenticated.
pConnectionData
Indentifies data specific to the connection, that is, data not specific to any particular user. If the fSaveConnectionData member is TRUE, RAS saves the connection data in the phone book. The authentication protocol should free the memory occupied by this data during the call to RasEapEnd.
dwSizeOfConnectionData;
Specifies the size, in bytes, of the data pointed to by the pConnectionData member.
fSaveUserData
Specifies whether RAS should save the user data pointed to by the pUserData member. If this parameter is TRUE, RAS saves the user-specific data in the registry under HKEY_CURRENT_USER.
pUserData
Pointer to user data that RAS should save in the registry. RAS saves this data in the registry under HKEY_CURRENT_USER. The authentication protocol should free this memory during the call to RasEapEnd.
dwSizeofUserData
Specifies the size in bytes of the data pointed to by pUserData.

Remarks

Use the RasEapMakeMessage function to pass the PPP_EAP_OUTPUT structure between the authentication protocol and the Connection Manager

The authentication protocol may use the PPP_EAP_OUTPUT structure to return the Microsoft Point to Point Encryption (MPPE) session key. The authentication protocol should place the session key in the value field of a sub-attribute contained within the value field of an attribute of type raatVendorSpecific (see RAS_AUTH_ATTRIBUTE_TYPE). The sub-attribute should have a Vendor-ID of 311 (Microsoft) and a Vendor-Type of 12 (MS-CHAP-MPPE-Keys). The authentication protocol should set the pUserAttributes member to point to the raatVendorSpecific attribute, and set the Action member to EAPACTION_Done or EAPACTION_SendAndDone. For more information about the format of the MPPE sub-attribute see Draft Radius MSCHAP Attr 01. For more information about attribute formats see RAS_AUTH_ATTRIBUTE, RAS_AUTH_ATTRIBUTE_TYPE, and RFC 2865.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Structures, RAS_AUTH_ATTRIBUTE, PPP_EAP_ACTION, RasEapInvokeInteractiveUI, RasEapMakeMessage


PPP_EAP_PACKET

The PPP_EAP_PACKET structure specifies information about a packet being processed by the authentication protocol.

typedef struct _PPP_EAP_PACKET {
  BYTE    Code;       // 1-Request, 2-Response, 3-Success, 4-Failure
  BYTE    Id;         // Id of this packet
  BYTE    Length[2];  // Length of this packet
  BYTE    Data[1];    // Data, First byte is Type for
                      // Request/Response
} PPP_EAP_PACKET, * PPPP_EAP_PACKET;

Members

Code
Specifies the type of packet that is sent or received by the authentication protocol. This parameter is one of the four following values.
Value | Meaning
EAPCODE_Request | The packet is a request.
EAPCODE_Response | The packet is a response.
EAPCODE_Success | The packet indicates success.
EAPCODE_Failure | The packet indicates failure.

Id
Specifies the identifier of the packet. The authentication protocol is responsible for maintaining packet counts for sessions, as that packet count pertains to EAP activity.
Length[2]
Specifies the length of the packet.
Data[1]
Specifies the data transmitted by this packet. If the packet is a request or a response packet, the first byte of this member signifies its type. For more information about packet types and requirements for type reservation, refer to RFC 2284.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Structures, RasEapGetInfo, RasEapMakeMessage, PPP_EAP_INFO, PPP_EAP_INPUT, PPP_EAP_OUTPUT


RAS_AUTH_ATTRIBUTE

The RAS_AUTH_ATTRIBUTE structure is used to pass authentication attributes, of type RAS_AUTH_ATTRIBUTE_TYPE, during an EAP session.

typedef struct _RAS_AUTH_ATTRIBUTE {
  RAS_AUTH_ATTRIBUTE_TYPE raaType;   // attribute type
  DWORD                   dwLength;  // length in bytes of Value
  PVOID                   Value;     // pointer to value or
                                     // contains value
}RAS_AUTH_ATTRIBUTE, *PRAS_AUTH_ATTRIBUTE;

Members

raaType
Specifies the type of attribute, as defined in the RAS_AUTH_ATTRIBUTE_TYPE enumerated type.
dwLength
Specifies the length in bytes of the value of this attribute. If the Value member is a pointer, dwLength specifies the length of the buffer pointed to. If the Value member is the value itself, dwLength specifies how much of the length of the Value member is taken up by the value.
Value
Specifies the value of the attribute. Although this member is of the PVOID type, this member sometimes contains the value of the attribute rather than pointing to the value. The only way to know whether to interpret the Value member as a pointer to the value or the value itself, is to check the raaType member. See the reference page for RAS_AUTH_ATTRIBUTE_TYPE for information about how the Value member should be interpreted for different types.

Remarks

Often an array of these structures is used to store or obtain a set of attributes for a given user. Since the number of attributes for a session is unknown, the array must be dynamic. The array is terminated by a structure with an raaType member that has a value of raatMinimum

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Structures, RAS_AUTH_ATTRIBUTE_TYPE


EAP Enumerated Types

Use the following enumerated types for authentication protocols and authentication providers:

PPP_EAP_ACTION

RAS_AUTH_ATTRIBUTE_TYPE


PPP_EAP_ACTION

The PPP_EAP_ACTION enumerated type specifies actions that the Connection Manager should take on behalf of the authentication protocol.

typedef enum _PPP_EAP_ACTION {
  EAPACTION_NoAction,        // Be passive, i.e., listen without
                             // timeout (default)
  EAPACTION_Authenticate,    // invoke the authentication provider
  EAPACTION_Done,            // End auth session, dwAuthResultCode
                             // is set
  EAPACTION_SendAndDone,     // As above but send message without
                             // timeout first
  EAPACTION_Send,            // Send message, don't timeout waiting
                             // for reply
  EAPACTION_SendWithTimeout, // Send message, timeout if reply not
                             // received
  EAPACTION_SendWithTimeoutInteractive // As above, but don't
                                       // increment retry count
} PPP_EAP_ACTION;

Values

EAPACTION_NoAction
Directs the Connection Manager to be passive.
EAPACTION_Authenticate
Directs the Connection Manager to invoke the authentication provider to authenticate the user.
EAPACTION_Done
Directs the Connection Manager Service to end the authentication session. EAPACTION_Done indicates that the dwAuthResultCode member of the PPP_EAP_OUTPUT structure is set with an appropriate value.
EAPACTION_SendAndDone
Directs the Connection Manager to send a message (without a time out), then end the authentication session. EAPACTION_SendAndDone indicates that the dwAuthResultCode member of the PPP_EAP_OUTPUT structure is set with an appropriate value.
EAPACTION_Send
Directs the Connection Manager to send a message without setting a time out to wait for a reply.
EAPACTION_SendWithTimeout
Directs the Connection Manager to send a message and set a time out to wait for a reply.
EAPACTION_SendWithTimeoutInteractive
Directs the Connection Manager to send a message and set a time out to wait for a reply, but instructs the Connection Manager not to increment the retry counter.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Enumerated Types, PPP_EAP_INPUT, PPP_EAP_OUTPUT


RAS_AUTH_ATTRIBUTE_TYPE

The RAS_AUTH_ATTRIBUTE_TYPE enumerated type specifies attribute values used for session authentication. Further details for values in this enumerated type are obtained by referring to one of the three following references: RFC 2865, Draft Radius Accounting v2 05, RFC 2869, or draft-ietf-radius-tunnel-09.

typedef enum _RAS_AUTH_ATTRIBUTE_TYPE_ {
  raatMinimum = 0,           // Undefined
  raatUserName,              // Value field is a pointer
  raatUserPassword,          // Value field is a pointer
  raatMD5CHAPPassword,       // Value field is a pointer
  raatNASIPAddress,          // Value field is a 32 bit integral value
  raatNASPort,               // Value field is a 32 bit integral value
  raatServiceType,           // Value field is a 32 bit integral value
  raatFramedProtocol,        // Value field is a 32 bit integral value
  raatFramedIPAddress,       // Value field is a 32 bit integral value
  raatFramedIPNetmask,       // Value field is a 32 bit integral value
  raatFramedRouting = 10,    // Value field is a 32 bit integral value
  raatFilterId,              // Value field is a pointer
  raatFramedMTU,             // Value field is a 32 bit integral value
  raatFramedCompression,     // Value field is a 32 bit integral value
  raatLoginIPHost,           // Value field is a 32 bit integral value
  raatLoginService,          // Value field is a 32 bit integral value
  raatLoginTCPPort,          // Value field is a 32 bit integral value
  raatUnassigned17,          // Undefined
  raatReplyMessage,          // Value field is a pointer
  raatCallbackNumber = 20,   // Value field is a pointer
  raatCallbackId,            // Value field is a pointer
  raatUnassigned21,          // Undefined
  raatFramedRoute,           // Value field is a pointer
  raatFramedIPXNetwork,      // Value field is a 32 bit integral value
  raatState,                 // Value field is a pointer
  raatClass,                 // Value field is a pointer
  raatVendorSpecific,        // Value field is a pointer
  raatSessionTimeout,        // Value field is a 32 bit integral value
  raatIdleTimeout,           // Value field is a 32 bit integral value
  raatTerminationAction,     // Value field is a 32 bit integral value
  raatCalledStationId = 30,  // Value field is a pointer
  raatCallingStationId,      // Value field is a pointer
  raatNASIdentifier,         // Value field is a pointer
  raatProxyState,            // Value field is a pointer
  raatLoginLATService,       // Value field is a pointer
  raatLoginLATNode,          // Value field is a pointer
  raatLoginLATGroup,         // Value field is a pointer
  raatFramedAppleTalkLink,   // Value field is a 32 bit integral value
  raatFramedAppleTalkNetwork,// Value field is a 32 bit integral value
  raatFramedAppleTalkZone,   // Value field is a pointer
  raatAcctStatusType = 40,   // Value field is a 32 bit integral value
  raatAcctDelayTime,         // Value field is a 32 bit integral value
  raatAcctInputOctets,       // Value field is a 32 bit integral value
  raatAcctOutputOctets,      // Value field is a 32 bit integral value
  raatAcctSessionId,         // Value field is a pointer
  raatAcctAuthentic,         // Value field is a 32 bit integral value
  raatAcctSessionTime,       // Value field is a 32 bit integral value
  raatAcctInputPackets,      // Value field is a 32 bit integral value
  raatAcctOutputPackets,     // Value field is a 32 bit integral value
  raatAcctTerminateCause,    // Value field is a 32 bit integral value
  raatAcctMultiSessionId = 50,// Value field is a pointer
  raatAcctLinkCount,         // Value field is a 32 bit integral value
  raatAcctEventTimeStamp = 55,  // Value field is a 32 bit integral value
  raatMD5CHAPChallenge = 60, // Value field is a pointer
  raatNASPortType,           // Value field is a 32 bit integral value
  raatPortLimit,             // Value field is a 32 bit integral value
  raatLoginLATPort,          // Value field is a pointer
  raatTunnelType,            // Value field is a 32 bit integral value
  raatTunnelMediumType,      // Value field is a 32 bit integral value
  raatTunnelClientEndpoint,  // Value field is a Pointer
  raatTunnelServerEndpoint,  // Value field is a Pointer
  raatARAPPassword = 70      // Value field is a pointer
  raatARAPFeatures,          // Value field is a pointer
  raatARAPZoneAccess,        // Value field is a 32 bit integral value
  raatARAPSecurity,          // Value field is a 32 bit integral value
  raatARAPSecurityData,      // Value field is a pointer
  raatPasswordRetry,         // Value field is a 32 bit integral value
  raatPrompt,                // Value field is a 32 bit integral value
  raatConnectInfo,           // Value field is a pointer
  raatConfigurationToken,    // Value field is a pointer
  raatEAPMessage,            // Value field is a pointer
  raatSignature = 80,        // Value field is a pointer
  raatARAPChallengeResponse = 84, // Value field is a pointer
  raatAcctInterimInterval = 85,    // Value field is a Pointer
  raatARAPGuestLogon = 8096, // Value field is a 32 bit integral value
  raatReserved = 0xFFFFFFFF  // Undefined
} RAS_AUTH_ATTRIBUTE_TYPE;

Values

raatMinimum
Specifies a value equal to zero, and used as the NULL terminator in any array of RAS_AUTH_ATTRIBUTE structures.
raatUserName
Specifies the name of the user to be authenticated. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatUserPassword
Specifies the password of the user to be authenticated. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatMD5CHAPPassword
Specifies the password provided by the user in response to an MD5 Challenge Handshake Authentication Protocol (CHAP) challenge. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatNASIPAddress
Specifies the Network Access Server (NAS) IP address. An Access-Request should specify either an NAS IP address or an NAS identifier. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatNASPort
Specifies the physical or virtual private network (VPN) through which the user is connecting to the NAS. Note that this value is not a port number in the sense of TCP or UDP. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatServiceType
Specifies the type of service the user has requested or the type of service to be provided. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatFramedProtocol
Specifies the type of framed protocol to use for framed access, for example SLIP, PPP, or ARAP (AppleTalk Remote Access Protocol). The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatFramedIPAddress
Specifies the IP address that is configured for the user requesting authentication. This attribute is typically returned by the authentication provider. However, the NAS may use it in an authentication request to specify a preferred IP address. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatFramedIPNetmask
Specifies the IP network mask for a user that is a router to a network. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatFramedRouting
Specifies the routing method for a user that is a router to a network. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatFilterId
Specifies the filter list for the user requesting authentication. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatFramedMTU
Specifies the Maximum Transmission Unit (MTU) for the user. This attribute is used in cases where the MTU is not negotiated through some other means, such as PPP. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatFramedCompression
Specifies a compression protocol to use for the connection. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatLoginIPHost
Specifies the system with which to connect the user. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatLoginService
Specifies the service to use to connect the user to the host specified by raatLoginIPHost. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatLoginTCPPort
Specifies the port to which to connect the user. This attribute is present only if the raatLoginService attribute is present. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatUnassigned17
This value is currently unassigned.
raatReplyMessage
Specifies a message to display to the user. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatCallbackNumber
Specifies a callback number. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatCallbackId
Specifies a location to call back. The value of this attribute is interpreted by the NAS. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatUnassigned21
This value is currently unassigned. The value field in RAS_AUTH_ATTRIBUTE for this type is also undefined.
raatFramedRoute
Specifies routing information to configure on the NAS for the user. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatFramedIPXNetwork
Specifies the IPX network number to configure for the user. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatState
Specifies state information provided to the client by the server. Refer to RFC 2865 for detailed information about this value. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer.
raatClass
Specifies a value that is provided to the NAS by the authentication provider. The NAS should use this value when communicating with the accounting provider. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatVendorSpecific
Specifies a field for vendor-supplied extended attributes. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatSessionTimeout
Specifies the maximum number of seconds for which to provide service to the user. After this time, the session is terminated. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatIdleTimeout
Specifies the maximum number of consecutive seconds the session can be idle. If the idle time exceeds this value, the session is terminated. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatTerminationAction
Specifies an action the server performs when time the connection terminates. Refer to the above-referenced files for detailed information about this value. The value field in RAS_AUTH_ATTRIBUTE for this type is 32-bit integral value. For more information, see RFC 2865.
raatCalledStationId
Specifies the number that the user dialed to connect to the NAS. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatCallingStationId
Specifies the number from which the user is calling. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatNASIdentifier
Specifies the NAS identifier. An Access-Request should specify either an NAS identifier or an NAS IP address. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatProxyState
Specifies a value that a proxy server includes when forwarding an authentication request. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatLoginLATService
Specifies an attribute that is not currently used for authentication on Windows 2000. For more information, see RFC 2865.
raatLoginLATNode
Specifies an attribute that is not currently used for authentication on Windows 2000. For more information, see RFC 2865.
raatLoginLATGroup
Specifies an attribute that is not currently used for authentication on Windows 2000. For more information, see RFC 2865.
raatFramedAppleTalkLink
Specifies the AppleTalk network number for the user when the user is another router. The value field in RAS_AUTH_ATTRIBUTE for this type is 32-bit integral value. For more information, see RFC 2865.
raatFramedAppleTalkNetwork
Specifies the AppleTalk network number that the NAS should use to allocate an AppleTalk node for the user. This attribute is used only when the user is not another router. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatFramedAppleTalkZone
Specifies the AppleTalk default zone for the user. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatAcctStatusType
Specifies whether the accounting provider should start or stop accounting for the user. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctDelayTime
Specifies the length of time that the client has been attempting to send the current request. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctInputOctets
Specifies the number of octets that have been received during the current accounting session. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctOutputOctets
Specifies the number of octets that were sent during the current accounting session. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctSessionId
Specifies a value to enable the identification of matching start and stop records within a log file. The start and stop records are sent in the raatAcctStatusType attribute. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see Draft Radius Accounting v2 05.
raatAcctAuthentic
Specifies, to the accounting provider, how the user was authenticated; for example by Windows 2000 Directory Services, RADIUS, or some other authentication provider. The value field in RAS_AUTH_ATTRIBUTEfor this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctSessionTime
Specifies the number of seconds that have elapsed in the current accounting session. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctInputPackets
Specifies the number of packets that have been received during the current accounting session. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctOutputPackets
Specifies the number of packets that have been sent during the current accounting session. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctTerminateCause
Specifies how the current accounting session was terminated. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctMultiSessionId
Specifies a value to enable the identification of related accounting sessions within a log file. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctLinkCount
Specifies the number of links if the current accounting session is using a multilink connection. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see Draft Radius Accounting v2 05.
raatAcctEventTimeStamp
Specifies an attribute that is included in an accounting request packet. It specifies the time that the event took place. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see the RFC 2869 internet draft.
raatMD5CHAPChallenge
Specifies the CHAP challenge sent by the NAS to a CHAP user. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2865.
raatNASPortType
Specifies the type of the port through which the user is connecting, for example, asynchronous, ISDN, virtual. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatPortLimit
Specifies the number of ports the NAS should make available to the user for multilink sessions. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2865.
raatLoginLATPort
Specifies an attribute that is not currently used for authentication on Windows 2000. For more information, see RFC 2865.
raatTunnelType
Specifies the tunneling protocol used. The following table lists valid tunnel types.
Tunnel Type Value | Description
1 | Point-to-Point Tunneling Protocol (PPTP)
2 | Layer Two Forwarding (L2F)
3 | Layer Two Tunneling Protocol (L2TP)
4 | Ascend Tunnel Management Protocol (ATMP)
5 | Virtual Tunneling Protocol (VTP)
6 | IP Authentication Header in the Tunnel-mode
7 | IP-in-IP Encapsulation (IP-IP)
8 | Minimal IP-in-IP Encapsulation (MIN-IP-IP)
9 | IP Encapsulating Security Payload in the Tunnel-mode (ESP)
10 | Generic Route Encapsulation (GRE)
11 | Bay Dial Virtual Services (DVS)
12 | IP-in-IP Tunneling

raatTunnelMediumType
Specifies which transport medium to use when creating a tunnel for those protocols (such as L2TP) that can operate over multiple transports. The following table lists valid medium types.
Medium Type Value | Description
1 | IPv4 (IP version 4)
2 | IPv6 (IP version 6)
3 | NSAP
4 | HDLC (8-bit multidrop)
5 | BBN 1822
6 | 802 (includes all 802 media plus Ethernet "canonical format")
7 | E.163 (POTS)
8 | E.164 (SMDS, Frame Relay, ATM)
9 | F.69 (Telex)
10 | X.121 (X.25, Frame Relay)
11 | IPX
12 | Appletalk
13 | Decnet IV
14 | Banyan Vines
15 | E.164 with NSAP format subaddress

raatTunnelClientEndpoint
Points to the address of the initiator end of the tunnel.
raatTunnelServerEndpoint
Points to the address of the server end of the tunnel.
raatARAPPassword
Specifies a password to use for AppleTalk Remote Access Protocol (ARAP) authentication. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2869 .
raatARAPFeatures
Specifies information that an NAS should send back to the user in an ARAP "feature flags" packet. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2869.
raatARAPZoneAccess
Specifies how to use the ARAP zone list for the user. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2869.
raatARAPSecurity
Specifies an ARAP security module to use during a secondary authentication phase between the NAS and the user. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral. For more information, see RFC 2869.
raatARAPSecurityData
Specifies the data to use with an ARAP security module. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2869.
raatPasswordRetry
Specifies the number of password retry attempts to permit the user access. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value.
raatPrompt
Specifies whether the NAS should echo the user response to a challenge. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2869.
raatConnectInfo
Specifies information about the type of connection the user is using. The value field in RAS_AUTH_ATTRIBUTE for this type is a Pointer. For more information, see RFC 2869.
raatConfigurationToken
Specifies user-profile information in communications between RADIUS Proxy Servers and RADIUS Proxy Clients. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2869.
raatEAPMessage
Specifies that EAP information be sent directly between the user and the authentication provider. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2869.
raatSignature
Specifies a signature to include with CHAP, EAP, or ARAP packets. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, RFC 2869.
raatARAPChallengeResponse
Specifies the response to a Apple Remote Access Protocol (ARAP) challenge. In ARAP, either the server or the client may respond to challenges. The value field in RAS_AUTH_ATTRIBUTE for this type is a pointer. For more information, see RFC 2869.
raatAcctInterimInterval
Specifies the time, in seconds, between accounting updates. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2869.
raatARAPGuestLogon
Specifies a Apple Remote Access Protocol (ARAP) guest logon. The value field in RAS_AUTH_ATTRIBUTE for this type is a 32-bit integral value. For more information, see RFC 2869.
raatReserved
The value field in RAS_AUTH_ATTRIBUTE for this type is undefined.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Raseapif.h.

See Also

Extensible Authentication Protocol Reference, EAP Enumerated Types, RAS_AUTH_ATTRIBUTE


Extensible Authentication Protocol COM Interface

Implement the following COM interface when implementing an authentication protocol for Microsoft® Windows® 2000 Server:

IEAPProviderConfig


IEAPProviderConfig

When to Implement

Implement the IEAPProviderConfig interface to provide a configuration UI for an EAP provider. This interface is for configuring the EAP provider on the server. For information about the client-side configuration, see the reference page for the RasEapInvokeConfigUI function.

When to Use

The system calls the methods of this interface when a user chooses to configure an EAP provider in the RRAS snap-in.

Methods in Vtable Order

IUnknown Methods | Description
Query Interface | Returns pointers to supported interfaces
AddRef | Increments reference count
Release | Decrements reference count

IEAPProviderConfig Methods | Description
Initialize | Initializes an EAP configuration session
Uninitialize | Shuts down an EAP configuration session
ServerInvokeConfigUI | Invokes the EAP configuration user interface
RouterInvokeConfigUI |
RouterInvokeCredentialsUI |

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Rrascfg.h.

See Also

Extensible Authentication Protocol Reference, Extensible Authentication Protocol COM Interface


IEAPProviderConfig::Initialize

The system calls the IEAPProviderConfig::Initialize method to initialize an EAP configuration session with the specified computer.

HRESULT Initialize(
  LPCOLESTR pszMachineName,       // pointer to computername
  DWORD dwEapTypeId,               // specifies the EAP
  ULONG_PTR * puConnectionParam   // pointer to config session ID
);

Parameters

pszMachineName
Pointer to a string that contains the name of the computer on which to configure EAP.
dwEapTypeId
Specifies the EAP for which to initialize a configuration session.
puConnectionParam
Pointer to an unsigned integer variable. On successful return, the value of this variable identifies this configuration session.

Return Values

If the function succeeds, the return value should be S_OK.

If the function fails, the return value should be one of the following codes.

Value | Description
E_FAIL | Non-specific error
E_INVALIDARG | One of the arguments is invalid
E_OUTOFMEMORY | The method failed because it was unable to allocate required memory
E_UNEXPECTED | An unexpected error occurred

Remarks

The configuration UI should allow the user to configure the EAP provider on a remote computer. Establish the connection to the remote computer during the call to IEAPProviderConfig::Initialize.

The DLL that implements IEAPProviderConfig may support more than one authentication protocol. The dwEapTypeId parameter specifies for which authentication protocol to initialize a configuration session.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Rrascfg.h.

See Also

Extensible Authentication Protocol Reference, Extensible Authentication Protocol COM Interface, IEAPProviderConfig, IEAPProviderConfig::RouterInvokeConfigUI, IEAPProviderConfig::RouterInvokeCredentialsUI, IEAPProviderConfig::ServerInvokeConfigUI, IEAPProviderConfig::Uninitialize


IEAPProviderConfig::Uninitialize

The system calls the IEAPProviderConfig::Uninitialize method to shutdown the specified EAP configuration session.

HRESULT Uninitialize(
  DWORD dwEapTypeId,           // specifies the EAP
  ULONG_PTR uConnectionParam   // config session ID
);

Parameters

dwEapTypeId
Specifies the EAP for which to shut down the configuration session.
uConnectionParam
Specifies the configuration session to shut down.

Return Values

If the function succeeds, the return value should be S_OK.

If the function fails, the return value should be one of the following codes.

Value | Description
E_FAIL | Non-specific error
E_INVALIDARG | One of the arguments is invalid
E_OUTOFMEMORY | The method failed because it was unable to allocate required memory
E_UNEXPECTED | An unexpected error occurred

Remarks

The configuration UI should allow the user to configure the EAP provider on a remote computer. Delete the connection to the remote computer during the call to IEAPProviderConfig::Uninitialize.

The DLL that implements IEAPProviderConfig may support more than one authentication protocol. The dwEapTypeId parameter specifies for which authentication protocol to shut down the configuration session.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Rrascfg.h.

See Also

Extensible Authentication Protocol Reference, Extensible Authentication Protocol COM Interface, IEAPProviderConfig, IEAPProviderConfig::Initialize, IEAPProviderConfig::RouterInvokeConfigUI, IEAPProviderConfig::RouterInvokeCredentialsUI, IEAPProviderConfig::ServerInvokeConfigUI


IEAPProviderConfig::ServerInvokeConfigUI

The system calls the IEAPProviderConfig::ServerInvokeConfigUI method to invoke the configuration user interface for EAP authentication between a remote access client and server.

HRESULT ServerInvokeConfigUI(
  DWORD dwEapTypeId,           // specifies the EAP
  ULONG_PTR uConnectionParam,  // config session id
  HWND hWnd,                   // handle to parent window
  ULONG_PTR uReserved1,       // reserved, should be zero
  ULONG_PTR uReserved2        // reserved, should be zero
);

Parameters

dwEapTypeId
Specifies the EAP for which to invoke the configuration user interface.
uConnectionParam
Specifies the configuration session for which to invoke the user interface.
hWnd
Handle to the parent window for the configuration user interface.
uReserved1
This parameter is reserved and should be zero.
uReserved2
This parameter is reserved and should be zero.

Return Values

If the function succeeds, the return value should be S_OK.

If the function fails, the return value should be one of the following codes.

Value | Description
E_FAIL | Non-specific error
E_INVALIDARG | One of the arguments is invalid
E_OUTOFMEMORY | The method failed because it was unable to allocate required memory
E_UNEXPECTED | An unexpected error occurred

Remarks

The DLL that implements IEAPProviderConfig may support more than one authentication protocol. The dwEapTypeId parameter specifies for which authentication protocol to invoke the configuration user interface.

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Rrascfg.h.

See Also

Extensible Authentication Protocol Reference, Extensible Authentication Protocol COM Interface, IEAPProviderConfig, IEAPProviderConfig::Initialize, IEAPProviderConfig::Uninitialize, IEAPProviderConfig::RouterInvokeConfigUI, IEAPProviderConfig::RouterInvokeCredentialsUI


IEAPProviderConfig::RouterInvokeConfigUI

The system calls the IEAPProviderConfig::RouterInvokeConfigUI method to invoke the configuration user interface for EAP authentication between two routers.

HRESULT RouterInvokeConfigUI (
  DWORD dwEapTypeId,               // specifies the EAP
  ULONG_PTR uConnectionParam,      // config session id
  HWND hwndParent,                 // handle to parent window
  DWORD dwFlags,                   // flag specifying router
                                   // to router authentication
  BYTE * pConnectionDataIn,        // current config data
  DWORD dwSizeOfConnectionDataIn,  // size of current config data
  BYTE ** ppConnectionDataOut,        // new config data
  DWORD * pdwSizeOfConnectionDataOut  // size of new config data
);

Parameters

dwEapTypeId
Specifies the EAP for which to invoke the configuration user interface.
uConnectionParam
Specifies the configuration session for which to invoke the user interface.
hwndParent
Handle to the parent window for the configuration user interface.
dwFlags
Specifies the RAS_EAP_FLAG_ROUTER flag. This is the only valid flag for this parameter. It indicates that authentication is between two routers. This parameter always includes this flag.
pConnectionDataIn
Pointer to the current configuration data for the interface.
dwSizeOfConnectionDataIn
Specifies the size of the current configuration data pointed to by the pConnectionDataIn parameter.
ppConnectionDataOut
Pointer to a pointer to a buffer that contains the new configuration data for the interface.
pdwSizeOfConnectionDataOut
Pointer to a DWORD variable to receive the size of the new configuration data.

Return Values

If the function succeeds, the return value should be S_OK.

If the function fails, the return value should be one of the following codes.

Value | Description
E_FAIL | Non-specific error
E_INVALIDARG | One of the arguments is invalid
E_OUTOFMEMORY | The method failed because it was unable to allocate required memory
E_UNEXPECTED | An unexpected error occurred

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Rrascfg.h.

See Also

Extensible Authentication Protocol Reference, Extensible Authentication Protocol COM Interface, IEAPProviderConfig, IEAPProviderConfig::Initialize, IEAPProviderConfig::RouterInvokeCredentialsUI, IEAPProviderConfig::ServerInvokeConfigUI, IEAPProviderConfig::Uninitialize


IEAPProviderConfig::RouterInvokeCredentialsUI

The system calls the IEAPProviderConfig::RouterInvokeCredentialsUI method to invoke the credentials user interface for EAP authentication between two routers.

HRESULT RouterInvokeCredentialsUI (
  DWORD dwEapTypeId,            // specifies the EAP
  ULONG_PTR uConnectionParam,   // config session id
  HWND hwndParent,              // handle to parent window
  DWORD dwFlags,                // flag specifying router
                                // to router authentication
  BYTE* pConnectionDataIn,          // current config data
  DWORD dwSizeOfConnectionDataIn,   // size of current config data
  BYTE* pUserDataIn,            // current credentials
  DWORD dwSizeOfUserDataIn,     // size of current credentials
  BYTE ** ppUserDataOut,        // new credentials
  DWORD * pdwSizeOfUserDataOut  // size of new credentials
);

Parameters

dwEapTypeId
Specifies the EAP for which to invoke the configuration user interface.
uConnectionParam
Specifies the configuration session for which to invoke the user interface.
hwndParent
Handle to the parent window for the configuration user interface.
dwFlags
Specifies the RAS_EAP_FLAG_ROUTER flag. This is the only valid flag for this parameter. It indicates that authentication is between two routers. This parameter always includes this flag.
pConnectionDataIn
Pointer to the current configuration data for the interface.
dwSizeOfConnectionDataIn
Specifies the size of the current configuration data pointed to by the pConnectionDataIn parameter.
pUserDataIn
Pointer to the current credential data for the interface.
dwSizeOfUserDataIn
Specifies the size of the current credentials data.
ppUserDataOut
Pointer to a pointer to a buffer to receive the new credentials data for the interface.
pdwSizeOfUserDataOut
Pointer to a DWORD variable to receive the size of the new credentials data.

Return Values

If the function succeeds, the return value should be S_OK.

If the function fails, the return value should be one of the following codes.

Value | Description
E_FAIL | Non-specific error
E_INVALIDARG | One of the arguments is invalid
E_OUTOFMEMORY | The method failed because it was unable to allocate the required memory
E_UNEXPECTED | An unexpected error occurred

Requirements

Windows NT/2000: Requires Windows 2000.
Header: Declared in Rrascfg.h.

See Also

Extensible Authentication Protocol Reference, Extensible Authentication Protocol COM Interface, IEAPProviderConfig, IEAPProviderConfig::Initialize, IEAPProviderConfig::RouterInvokeConfigUI, IEAPProviderConfig::ServerInvokeConfigUI, IEAPProviderConfig::Uninitialize


Topic Not Found

No matching topic was found. Some possible reasons and remedies are as follows:

  • The file (.chm) that contains the destination topic is not in the expected location.

    Remedy: Rerun the MSDN Library Setup.

  • The file (.chm) that contains the current topic or destination topic is out-of-date and the link is no longer valid.

    Remedy: Install the latest version of the MSDN Library.

  • The MSDN Library CD is not in the CD-ROM drive.

    Remedy: Insert the MSDN Library CD into the CD-ROM drive.