Best practice for client side certificate configuration - QUIC_CREDENTIAL_CONFIG

[liwass]

I am using the following from the sample (tried secure and unsecure) for client side communication with Server 2022 for SMB over QUIC.

CredConfig.Type = QUIC_CREDENTIAL_TYPE_NONE;
CredConfig.Flags = QUIC_CREDENTIAL_FLAG_CLIENT;
if (Unsecure) {
    CredConfig.Flags |= QUIC_CREDENTIAL_FLAG_NO_CERTIFICATE_VALIDATION;
}

Connection is established and stream is open, but SMB authentication fails for unknown reason (works fine over TCP).
Suspecting insufficient certificate configuration here maybe,
the question is which other types/flags for QUIC_CREDENTIAL_CONFIG should be used?

[nibanks]

You'll have to work with the SMB folks to debug any issues above MsQuic. I'll ping them to see if they might weigh in on this some more.

[nedpyle]

Hi. The SMB authentication doesn't use the certificate, it uses Windows NTLM or Kerberos security, depending on how you configured your file server at https://aka.ms/smboverquic. One way to test the server is setup correctly is just to use a Windows 11 client to connect and verify that it works (you can use a Windows Insider version of Windows 11 running as a VM, it's free - https://blogs.windows.com/windows-insider/2021/12/08/announcing-windows-11-insider-preview-build-22518/ is latest Dev channel). Some steps:

1. Test with TCP first to the same server on the same network, confirm that auth works fine without QUIC. Can use Any Windows 10 or 11 client.
2. Test with Windows 11 client for QUIC if Initial Commit of MsQuic Code #1 succeeded. If failing, can gather data using a script we can provide that works on Windows.

[liwass]

Hi, the server operates fine both over TCP and over QUIC, tested with Windows 11 Insider client.
In proprietary Client SMB over QUIC implementation trying both NTLM and Kerberos and both are rejected over QUIC, Event Viewer info:
EventID: 551
Status: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xC000006D)
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: SPN optional / no validation

[nedpyle]

Aha, you are ahead of the game here, excellent :). Same bad username or password error for NTLM, I presume (its logging is suckier than Kerbs)?

When you say proprietary here, you mean your own client using the same creds that work in Windows 11's client, correct? What OS/Distro is your proprietary client running on?