Setting Security at the Interface Proxy Level

Sometimes the client needs fine-grained control over the security on calls to particular interfaces. For example, security might be set at a low level for the process but calls to a particular interface might require a higher authentication level, such as encryption. The methods of the IClientSecurity interface allow the client to change the security settings associated with calls to a particular interface by controlling the security settings at the interface-proxy level.

The client can query an existing object for IClientSecurity and then call the IClientSecurity::QueryBlanket method to find out what the current security settings are for a particular interface proxy. The IClientSecurity::SetBlanket method can be used to modify the security settings for an individual interface proxy on the object before calling one of the interface's methods. The new settings apply to any future callers of this particular interface. The IClientSecurity::CopyProxy method provides a way for the client to copy an interface proxy so that subsequent calls to SetBlanket on the copy do not affect callers of the original proxy.

SetBlanket is commonly used to raise the authentication level for a particular interface proxy to a higher level of security protection. However, in some situations, it might also be helpful to lower the authentication level for a particular interface proxy. For instance, suppose the default authentication level for the process is some value other than RPC_C_AUTHN_LEVEL_NONE and the client and server are in separate domains that do not trust each other. In this case, calls to the server will fail unless the client calls SetBlanket to lower the authentication level to RPC_C_AUTHN_LEVEL_NONE.

Clients using the default implementation of IClientSecurity provided by the proxy manager can call the CoQueryProxyBlanket, CoSetProxyBlanket, and CoCopyProxy helper functions instead of calling IClientSecurity methods directly. The helper functions simplify the code but are slightly less efficient than calling the corresponding IClientSecurity methods directly.

The IClientSecurity interface is implemented locally for the client by the proxy manager. Some custom marshaled objects might not support IClientSecurity.

IClientSecurity works with all supported authentication services (currently NTLMSSP, Schannel, and the Kerberos v5 protocol).

Setting Security for COM Applications