lithnet / windows-credential-provider

A library for creating secure Windows Credential Providers in .NET
MIT License
18 stars 5 forks source link

how to unlock using a device without the user need to press a button #7

Open AmrRahmy opened 3 months ago

AmrRahmy commented 3 months ago

Is there a way to unlock programmatically without the user having to press the return key? i want to unlock based on a card reader result without input from user.

ryannewington commented 3 months ago

@AmrRahmy I dont think so, but it's worth having a detailed read through the technical reference doc to see if there are any specific workarounds for your scenario

https://www.microsoft.com/en-us/download/details.aspx?id=53556

iLikeToCode commented 3 days ago

@AmrRahmy maybe could make sure the submit buttons interactive state is focused and try press enter on keyboard with code

AmrRahmy commented 3 days ago

@AmrRahmy maybe could make sure the submit buttons interactive state is focused and try press enter on keyboard with code

This was a while ago now. Normally you can't use simulated key strokes or mouse clicks on that window. I think windows is stopping you from that. So It would need to be emulating an hid keyboard or something. Also, don't have control to focus on things, it's not an application I made, it's a built in application or screen by windows.

remote desktop applications seem to be able to take over the screen, where the main screen turns off, and you can control keyboard and mouse on the lock screen, but i didn't look into what is happening at that moment.

Anyway, I didn't think simulating key strokes like that would be reliable for the intended application. Any windows update can lock non tech people from logging in once you remove other options of unlocking the PC. I didn't revisit this project, but I would have to look more into windows hello or those unlock usb devices or the facial windows hello thing. I never used any of those options on windows. On phones, they work.

Having the user to press a button on the lock screen I think is a decent compromise, he is about to use the pc/laptop anyway.

iLikeToCode commented 3 days ago

You could make it call a macro, they can launch programs.

Also by focussed I just meant

submit.InteractiveState = InteractiveState.Focused

AmrRahmy commented 3 days ago

You could make it call a macro, they can launch programs.

What is 'it'? when on the lock screen, the dll is not running. it runs only when the user clicks the credential provider unlock button/icon.

I don't know of a way to trigger the dll from a service or background application, otherwise, i can keep a windows service running to detect the current top application running, when it's the idle or lock screen, trigger an action. I don't have that action as a function I can call or run or trigger.

iLikeToCode commented 3 days ago

there is a function to tell you when the thing is selected i think

iLikeToCode commented 3 days ago

credential providers can definitely launch applications

iLikeToCode commented 3 days ago

make the dll wait for card reader input before allowing login, and a service that does the same and then presses enter

AmrRahmy commented 3 days ago

if you don't mind, can you provide me a sample solution to create the dll that unlocks on the lock screen, without any condition or card reader. just unlock on lock screen?

I think the issue i was having is how to trigger this function from the lock or idle screen,

protected override CredentialResponseBase GetCredentials();

without the user pressing on the icon first. Looks like a callback to me, triggered by windows.

Email in my profile, same username at gmail

iLikeToCode commented 3 days ago

i’ll have a go later just sending this for my own memory, i’m at school rn but I’m quite familiar with this package so i’ll see what i can do

AmrRahmy commented 3 days ago

Thank you.

Maxhy commented 3 days ago

This should be avoided if possible. It would be better to disable this Lock Screen policy when installing your credential provider. The GPO is available from Administrative Templates => Personalization => Do Not Display the Lock Screen

Or with this reg file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization]
"NoLockScreen"=dword:00000001
AmrRahmy commented 3 days ago

This should be avoided if possible. It would be better to disable this Lock Screen policy when installing your credential provider. The GPO is available from Administrative Templates => Personalization => Do Not Display the Lock Screen

Is the lock screen the first screen? the one where it doesn't show the user name and password and the credential provider icon? That screen is not the main issue here. in that screen i think you can trigger a a key or mouse press.

Maxhy commented 3 days ago

Ah ok, then I guess for that the official way is to call CredentialsChanged on CredentialProviderEvents then use a condition to set AutoLogon when creating the credentials. This is complicate with the current API of this library abstraction to be honest as NotifyHostOfTileCollectionChange method is private and not protected, you will have difficulties to trigger such event. That's the only way I'm aware of with Credential Provider to avoid keyboard emulation hack.

iLikeToCode commented 3 days ago

or just make a service that listens for whatever input you want and hits enter for yoi

iLikeToCode commented 3 days ago

but obviously would cause issues if not on rfid screen, but then who would swipe not on rfid provider