SSPI Mutual Authentication Is Indicated on the Client Side But Not on the Server Side (304161)


The information in this article applies to:

  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
This article was previously published under Q304161

SYMPTOMS

When you are using an Schannel SSPI package, ASC_RET_MUTUAL_AUTH is not set on return in the context attributes parameter. The AcceptSecurityContext API returns with ASC_RET_MUTUAL_AUTH not set, even though mutual authentication was achieved.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

The English version of this fix should have the following file attributes or later:
   Date       Time   Version           Size     File name
   ---------------------------------------------------------
   02-Jan-02  13:56  5.0.2195.4685     123,664  Adsldp.dll
   02-Jan-02  13:56  5.0.2195.4762     130,320  Adsldpc.dll
   02-Jan-02  13:56  5.0.2195.4016      62,736  Adsmsext.dll
   02-Jan-02  13:56  5.0.2195.4797     356,112  Advapi32.dll
   02-Jan-02  13:56  5.0.2195.4571      82,704  Cmnquery.dll
   02-Jan-02  13:56  5.0.2195.4141     133,904  Dnsapi.dll
   02-Jan-02  13:56  5.0.2195.4379      91,408  Dnsrslvr.dll
   02-Jan-02  13:56  5.0.2195.4534      41,744  Dsfolder.dll
   02-Jan-02  13:56  5.0.2195.4534     156,944  Dsquery.dll
   02-Jan-02  13:56  5.0.2195.4574     110,352  Dsuiext.dll
   03-Jan-02  17:26  5.0.2195.4685     521,488  Instlsa5.dll
   03-Jan-02  17:27  5.1.2195.0        164,112  Instsch5.dll
   02-Jan-02  13:56  5.0.2195.4630     145,680  Kdcsvc.dll
   26-Nov-01  18:33  5.0.2195.4680     199,440  Kerberos.dll
   03-Jan-02  17:22  5.0.2195.4797     708,880  Kernel32.dll
   04-Sep-01  10:32  5.0.2195.4276      71,024  Ksecdd.sys
   26-Nov-01  19:55  5.0.2195.4685     503,568  Lsasrv.dll
   26-Nov-01  19:55  5.0.2195.4685      33,552  Lsass.exe
   07-Dec-01  18:05  5.0.2195.4745     107,280  Msv1_0.dll
   02-Jan-02  13:56  5.0.2195.4594     306,960  Netapi32.dll
   02-Jan-02  13:56  5.0.2195.4686     359,184  Netlogon.dll
   02-Jan-02  13:56  5.0.2195.4746     916,240  Ntdsa.dll
   02-Jan-02  13:56  5.0.2195.4748     388,368  Samsrv.dll
   02-Jan-02  13:56  5.0.2195.4583     128,784  Scecli.dll
   02-Jan-02  13:56  5.0.2195.4600     299,792  Scesrv.dll
   02-Jan-02  13:52  5.1.2195.0        146,192  Schannel.dll
   30-May-01  02:03  5.0.2195.3649       3,584  Spmsg.dll
   02-Jan-02  13:56  5.0.2195.4600      48,400  W32time.dll
   06-Nov-01  13:43  5.0.2195.4600      56,592  W32tm.exe
   02-Jan-02  13:56  5.0.2195.4769     125,712  Wldap32.dll

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.

MORE INFORMATION

With MUTUAL_AUTH, the communicating parties must authenticate their identities to each other. The SSPI client requests for ISC_REQ_MUTUAL_AUTH in the InitializeSecurityContext API and the server requests for ASC_REQ_MUTUAL_AUTH in the AcceptSecurityContext API. On return, the SSPI client indicates that ISC_RET_MUTUAL_AUTH was achieved. But the server indicates that ISC_RET_MUTUAL_AUTH was not achieved, even though mutual authentication succeeded.

For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 Datacenter Program and Windows 2000 Datacenter Server Product

For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:

296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot

For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes

Modification Type:MinorLast Reviewed:9/26/2005
Keywords:kbHotfixServer kbQFE kbbug kbenv kbfix kbSecurity kbui kbWin2000PreSP3Fix kbWin2000sp3fix KB304161
©2004 Microsoft Corporation. All rights reserved.