SSPI Options for Distributed Applications

Developers have many options for building distributed applications. The SSPI provides an abstraction layer between application-level protocols and security protocols. Applications can take advantage of SSPI's security protocols in several ways:

• Call SSPI routines directly (for traditional, socket-based applications).

  The routines use request/response messages to implement the application protocol that carries SSPI security-related data.

• Use COM to call security options that are implemented using authenticated RPC and SSPI at lower levels.

  These applications do not call SSPI APIs directly.

• Use Windows Sockets 2.0 (WinSock) with the extended WinSock interface to allow transport providers to use security features.

  This approach integrates the SSP into the network stack and provides both security and transport services through a common interface.

• Use Windows Internet Extensions API (WinInet) and an interface designed to support Internet security protocols such as the Secure Sockets Layer (SSL) protocol.

  Applications use the SSPI interface to the Secure Channel security provider to implement WinInet security. The Secure Channel is the Microsoft® Windows NT/Microsoft® Windows 2000 implementation of SSL.

Several SSPI functions return timestamps representing the lifespan of various objects. A security package is free to maintain time and provide timestamps in any fashion, but using local time simplifies the work of applications using SSPI functions.