COM settings in OPC Classic client components: Difference between revisions
From OPC Labs Knowledge Base
No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
[[Category:COM/DCOM]] [[Category:Troubleshooting]] | [[Category:COM/DCOM]] [[Category:Troubleshooting]] | ||
This article describes the internal effects of the UseCustomSecurity, TurnOffCallSecurity and | This article describes the internal effects of the UseCustomSecurity, TurnOffCallSecurity, TurnOffActivationSecurity and EnsureDataIntegrity settings. | ||
'''COM and proxy initialization:''' | '''COM and proxy initialization:''' | ||
| Line 17: | Line 17: | ||
(see https://docs.microsoft.com/en-us/windows/win32/com/turning-off-activation-security?redirectedfrom=MSDN) | (see https://docs.microsoft.com/en-us/windows/win32/com/turning-off-activation-security?redirectedfrom=MSDN) | ||
'''Common authentication level:''' RPC_C_AUTHN_LEVEL_CONNECT (2). | '''Common authentication level:''' In QuickOPC versions up to 2021.3: Always RPC_C_AUTHN_LEVEL_CONNECT (2). In QuickOPC versions 2022.1 and later: | ||
* Without EnsureDataIntegrity (the default): RPC_C_AUTHN_LEVEL_CONNECT (2). | |||
* With EnsureDataIntegrity: RPC_C_AUTHN_LEVEL_PKT_INTEGRITY (5). For [https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414)]. | |||
Revision as of 18:07, 26 January 2022
This article describes the internal effects of the UseCustomSecurity, TurnOffCallSecurity, TurnOffActivationSecurity and EnsureDataIntegrity settings.
COM and proxy initialization:
- Without UseCustomSecurity: CoInitializeSecurity is not called, CoSetProxyBlanket is not called
- With UseCustomSecurity (the default): CoInitializeSecurity is called, CoSetProxyBlanket is called
CoInitializeSecurity parameters:
- Without TurnOffCallSecurity (the default): dwAuthnLevel = Common authentication level (see below); dwImpLevel = RPC_C_IMP_LEVEL_IMPERSONATE (3); pSecDesc = CSecurityDescriptor::InitializeFromThreadToken()>
- With TurnOffCallSecurity: dwAuthnLevel = RPC_C_AUTHN_LEVEL_NONE (1); dwImpLevel = RPC_C_IMP_LEVEL_IMPERSONATE (3); pSecDesc = NULL
CoSetProxyBlanket parameters: dwAuthnLevel and dwImpLevel are the same as those used with CoInitializeSecurity.
COAUTHINFO* pAuthInfo in COSERVERINFO* passed to CoCreateInstanceEx (when machine name is not empty):
- Without TurnOffActivationSecurity (the default): dwAuthnSvc = RPC_C_AUTHN_NONE; dwAuthzSvc = RPC_C_AUTHZ_NONE; pwszServerPrincName = NULL; dwAuthnLevel = RPC_C_AUTHN_LEVEL_NONE; dwImpersonationLevel = RPC_C_IMP_LEVEL_IMPERSONATE; pAuthIdentityData = NULL; dwCapabilities = EOAC_NONE;
- With TurnOffActivationSecurity: NULL
Common authentication level: In QuickOPC versions up to 2021.3: Always RPC_C_AUTHN_LEVEL_CONNECT (2). In QuickOPC versions 2022.1 and later:
- Without EnsureDataIntegrity (the default): RPC_C_AUTHN_LEVEL_CONNECT (2).
- With EnsureDataIntegrity: RPC_C_AUTHN_LEVEL_PKT_INTEGRITY (5). For KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414).
