Change in Microsoft Vista security system promises Windows migration headaches

Corporate users with third-party, Windows-based authentication systems such as VPNs could face a difficult transition to Microsoft's Vista because of an overhaul of the core Windows logon architecture, according to independent software vendors and analysts.

The good news for users is that those same observers say Vista, which is being touted for its security features, will eventually deliver a more secure and flexible authentication architecture than exists today in Windows.

But ISVs say rewriting their code for the new architecture will produce headaches that will extend to their customers that have deployed strong authentication such as biometrics or tokens, enterprise single sign-on and a number of other systems integrated with the Windows authentication architecture.

"Not only the vendors, but the customers that have [authentication systems] already deployed are going to go through a lot of pain," says one ISV who asked not to be named. "We knew there were going to be changes, but we didn't know there would be wholesale changes."

Users will have to go through testing periods after vendors deliver new interfaces for their products. During migrations, users will have key security infrastructures that straddle two different authentication environments, one for Vista and one for earlier versions of Windows, until migrations are complete. They also will have to support different client-side code and separate interfaces that will present retraining issues, experts say.

In addition, users with any homegrown authentication mechanisms linked to Windows will have to rewrite their code from the ground up.

ISVs also have to completely rewrite and certify the custom code they write to interface with Winlogon, the Windows process that manages logon and logoff. That task will be painful in part because ISVs say Vista's new authentication architecture is incomplete in the beta released in February. The new architecture, called Winlogon Re-Architecture, includes a model for building modules called Credential Provider. The February CTP also was the first time Microsoft included in the release notes the fact that the GINA architecture had been abandoned even though the company had started talking about it at its Professional Developers Conference last September.

The previous model, called Graphical Identification and Authentication (GINA), is used by ISVs such as Check Point, Cisco, Citrix, Nortel, Novell, RSA Security and Symantec to link their authentication technology into the Windows authentication architecture.

"There are things built into GINA that are not in the existing Winlogon module you get with the Vista beta," says the ISV who requested anonymity. "Other pieces must be coming in later betas. If not, this makes the strategy of waiting for the first Vista service pack even more valid." Historically, many corporate users have waited for Service Pack 1 of a new operating system before adopting it. Continued