SurePassID Windows Login Manager Architecture Overview

SurePassID Authentication Server

SurePassID Windows Login Manager - Architecture Overview

WindowsLoginManager is a Windows Credential Provider — an in-process COM server (DLL) that Windows (LogonUI.exe / winlogon.exe) loads to render logon tiles and to collect and validate credentials during interactive logon, unlock, and Remote Desktop sessions.

High-level components

+-------------------------------------------------------------+
|                     Windows LogonUI / winlogon             |
+------------------------------+------------------------------+
                               | COM (ICredentialProvider)
                               v
+-------------------------------------------------------------+
|        WindowsLoginManager.dll (Credential Provider)        |
|                                                             |
|  Dll.cpp ............ COM class factory + DllGetClassObject  |
|  Credential Provider  ICredentialProvider / Filter impl.    |
|  Credential (tile) .. field descriptors, serialization,     |
|                       Kerberos/NegotiatePassword packaging  |
|  ConfigurationManager  reads policy from the registry       |
|  AuthenticationDecisionEngine  SFA fallback decision logic   |
|  CSurePassClientLib .. MFA orchestration, bypass, offline    |
|  UI windows .......... CAuthOptionsWindow, CPushStatusWindow, |
|                        CFidoStatusWindow                      |
+----------------+-----------------------------+--------------+
                 |                             |
                 v                             v
      +--------------------+        +------------------------+
      |   SurePassIdLib    |        |     SPWebAuthnLib      |
      | MFA server client  |        | FIDO2 / U2F / CTAP /   |
      | HTTP, JSON, crypto |        | CBOR / APDU / NFC/USB  |
      +---------+----------+        +------------------------+
                |
                v
      +--------------------+
      | SurePassID MFA /   |
      | Auth Server (HTTP) |
      +--------------------+

Projects

Credential Provider DLL (root)

• Dll.cpp — Standard DLL entry points and the CClassFactory implementation. CreateInstance dispatches to either the credential provider (SurePassId_CreateInstance) or the credential filter (SurePassIdFilter_CreateInstance) based on the requested interface.
• Credential provider / filter — Implements ICredentialProvider and ICredentialProviderFilter. Enumerates logon tiles and supplies field descriptors for the logon UI.
• Credential (tile) — Represents a single logon tile: manages the field values (username, password, OTP, status text, links, images), serializes the credential into a Kerberos/Negotiate logon package, and reports authentication results back to Windows.
• ConfigurationManager — Central place for reading policy from the registry (offline OTP option, username cache, SFA domain whitelist, proxy, timeouts, allowed auth methods, etc.).
• AuthenticationDecisionEngine — Pure decision logic that decides whether a single-factor (SFA) fallback is permitted, based on the configured SFAFallbackOption, the FindUser result, and the user's registered device count. Kept free of side effects so it can be unit tested in isolation.
• CSurePassClientLib — Orchestrates the MFA flow: bypass-code checking ({pt}, {sha256}, {notallowed} forms), offline OTP cache validation, RDP-session detection, and calls into SurePassIdLib for online verification.
• UI windows — CAuthOptionsWindow (choose auth method), CPushStatusWindow (push approval progress), and CFidoStatusWindow (security-key prompts).

SurePassIdLib — MFA server client

Typed request/response objects for the SurePassID server API, plus supporting infrastructure:

• Server operations: FindUser, SendOtp, SendPushMessage, GetMfaServerTime, and the legacy MFA server JSON request/response objects.
• Infrastructure: SPHttp (HTTP), SPJson/SPJsonObject (JSON), SPCrypto/ChilkatUtil (crypto), SPRegistry (registry access), SPLog (tracing and Windows event log), PropertyFile, and BinaryData.

SPWebAuthnLib — FIDO2 / U2F

A self-contained WebAuthn/CTAP implementation:

• CTAP objects: CtapAuthenticatorGetAssertion, CtapAuthenticatorMakeCredential, CtapAuthenticatorGetInfo, and their input-params/response variants.
• Encoding: CBOR, CborEncoder, CborDecoder.
• Transport: APDU, ApduCommand, ApduResponse, and the FIDO2/U2F APDU command classes.
• Authenticators: NFC and USB security-key discovery, connection, and state management (see SPWebAuthnLib/README).

Authentication flow (typical online push/OTP)

1. Windows loads the provider and asks it to enumerate credential tiles.
2. The user selects the SurePassID tile and enters their Windows username and password.
3. ConfigurationManager reads policy from the registry; the credential determines which second factors are allowed (AutoAuthMethod, Allow*).
4. SurePassIdLib calls FindUser to resolve the user and their registered devices.
5. AuthenticationDecisionEngine decides whether SFA fallback applies (e.g. no SurePassID user, or a user with no 2FA devices, under the configured SFAFallbackOption).
6. If MFA is required, the provider sends a push (SendPushMessage) or an OTP (SendOtp) and shows the appropriate status window, or prompts for a FIDO2 security key via SPWebAuthnLib.
7. On success, the credential serializes the Windows password into a Kerberos/Negotiate logon package and returns it to LogonUI, completing the sign-in.

Offline authentication

When the server is unreachable, the provider can fall back to a locally cached, encrypted OTP (OfflineCache / OfflineCacheIndex) if AllowOffLineAuth policy permits. The offline behavior (OFFLINE_OPTION_2FA, OFFLINE_OPTION_OFFLINE2FA, OFFLINE_OPTION_1FA) is derived from the AllowOffLineAuth registry value by ConfigurationManager::GetOfflineOtpOption.

Logging & diagnostics

SPLog provides tracing (SPLog::Trace) and Windows Security event logging (SPLog::SecurityEvent). Trace output is controlled by LogLevel and TraceFilePath registry values. See CONFIGURATION.