<div class="content" name="FW_AUTH_SET" uuid="bbec7ab7-0a1d-49a4-9c8e-a4784bbe6f16"><p>This structure contains a list of <span><a href="447c3a4c-9543-495d-ab7d-b7ca639712ef" data-linktype="relative-path">FW_AUTH_SUITE</a></span>
elements that are ordered from highest to lowest preference and are negotiated
with remote peers to establish authentication algorithms.</p><dl>
<dd>
<div><pre> typedef struct _tag_FW_AUTH_SET {
   struct _tag_FW_AUTH_SET* pNext;
   unsigned short wSchemaVersion;
   [range(FW_IPSEC_PHASE_INVALID+1, FW_IPSEC_PHASE_MAX-1)] 
     FW_IPSEC_PHASE IpSecPhase;
   [string, range(1,255), ref] wchar_t* wszSetId;
   [string, range(1,10001)] wchar_t* wszName;
   [string, range(1,10001)] wchar_t* wszDescription;
   [string, range(1,10001)] wchar_t* wszEmbeddedContext;
   [range(0,1000)] unsigned long dwNumSuites;
   [size_is(dwNumSuites)] PFW_AUTH_SUITE pSuites;
   [range(FW_RULE_ORIGIN_INVALID,FW_RULE_ORIGIN_MAX-1)] 
     FW_RULE_ORIGIN_TYPE Origin;
   [string, range(1,10001)] wchar_t* wszGPOName;
   FW_RULE_STATUS Status;
   unsigned long dwAuthSetFlags;
 } FW_AUTH_SET,
  *PFW_AUTH_SET;
</pre></div>
</dd></dl><p><b>pNext:</b>  A pointer to the next FW_AUTH_SET
in the list.</p><p><b>wSchemaVersion:</b>  Specifies the
version of the set. </p><p><b>IpSecPhase:</b>  This field is of type <span><a href="e23d75ab-c5f1-4b77-b290-f0e0e25d72e1" data-linktype="relative-path">FW_IPSEC_PHASE</a></span>,
and it specifies if this authentication set applies for first or second
authentications.</p><p><b>wszSetId:</b>  A pointer to a <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_c305d0ab-8b94-461a-bd76-13b40cb8c4d8" data-linktype="relative-path">Unicode</a></span>
string that uniquely identifies the set. The primary set for this policy object
is identified with the &#34;{E5A5D32A-4BCE-4e4d-B07F-4AB1BA7E5FE3}&#34;
string for Phase1 and the &#34;{E5A5D32A-4BCE-4e4d-B07F-4AB1BA7E5FE4}&#34;
string for Phase2.</p><p><b>wszName:</b>  A pointer to a Unicode
string that provides a friendly name for the set.</p><p><b>wszDescription:</b>  A pointer to a
Unicode string that provides a friendly description for the set.</p><p><b>wszEmbeddedContext:</b>  A pointer to a
Unicode string that provides a way for applications to store relevant
application-specific context that is related to the set. </p><p><b>dwNumSuites:</b>  Specifies the number
of authentication suites that the structure contains.</p><p><b>pSuites:</b>  A pointer to an array of
FW_AUTH_SUITE elements. The number of elements is given by <b>dwNumSuites</b>.</p><p><b>Origin:</b>  This field is the set
origin, as specified in the <span><a href="9d295321-d75c-41c0-ab0d-7a78df40f77c" data-linktype="relative-path">FW_RULE_ORIGIN_TYPE</a></span>
enumeration. It MUST be filled on enumerated rules and ignored on input.</p><p><b>wszGPOName:</b>  A pointer to a Unicode
string containing the displayName of the <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_dec32233-8776-4151-91a0-8624a2b9abb0" data-linktype="relative-path">GPO</a></span> containing this
object. When adding a new object, this field is not used. The client SHOULD set
the value to NULL, and the server MUST ignore the value. When enumerating an
existing object, if the client does not set the
FW_ENUM_RULES_FLAG_RESOLVE_GPO_NAME flag, the server MUST set the value to
NULL. Otherwise, the server MUST set the value to the displayName of the GPO
containing the object or NULL if the object is not contained within a GPO. For
details about how the server initializes an object from a GPO, see section <span><a href="e8924ac5-aa4a-41d1-bf65-4f46b3d399aa" data-linktype="relative-path">3.1.3</a></span>.
For details about how the displayName of a GPO is stored, see <span><a href="../ms-gpol/62d12924-6252-4052-996f-161d2b9019f4" data-linktype="relative-path">[MS-GPOL]</a></span>
section <span><a href="../ms-gpol/a0b3f9f6-da35-4c8a-8b8d-1318d4673e9d" data-linktype="relative-path">2.3</a></span>.</p><p><b>Status:</b>  The status code of the set
which MUST be one of the values defined in the <span><a href="c4fd81e6-38dd-47c5-8a0f-a98a11cf190e" data-linktype="relative-path">FW_RULE_STATUS</a></span>
enumeration. This field&#39;s value is assigned when the structure is returned as
output. When first sent, this field MUST be set to FW_RULE_STATUS_OK.</p><p><b>dwAuthSetFlags:</b>  Bit flags from
FW_AUTH_SET_FLAGS.</p><p>The following are semantic checks that authentication sets
MUST pass:</p><ul><li><p><span><span> 
</span></span>The <b>wSchemaVersion</b> field MUST NOT be less than 0x000200.</p>
</li><li><p><span><span> 
</span></span>The <b>wszSetId</b> field MUST NOT contain the pipe (|)
character, MUST NOT be NULL, MUST be a string of at least 1 character long, and
MUST NOT be greater than or equal to 255 characters. </p>
</li><li><p><span><span> 
</span></span>If the <b>wszName</b> field string is not NULL, it MUST be at
least 1 character long, MUST NOT be greater than or equal to 10,000 characters,
and MUST NOT contain the pipe (|) character.</p>
</li><li><p><span><span> 
</span></span>If the <b>wszDescription</b> field string is not NULL, it MUST be
at least 1 character long, MUST NOT be greater than or equal to 10,000
characters, and MUST NOT contain the pipe (|) character.</p>
</li><li><p><span><span> 
</span></span>If the <b>wszEmbeddedContext</b> field string is not NULL, it
MUST be at least 1 character long, its length MUST NOT be greater than or equal
to 10,000 characters, and MUST NOT contain the pipe (|) character.</p>
<p>If the method of a suite is
machine certificate or user certificate, and its <b>pCertCriteria</b> field is
not NULL, then the <b>wSchemaVersion</b> of the <b>pCertCriteria</b> field MUST
be equal to the schema version specified in the <b>wSchemaVersion</b> field of
the auth set containing the suite.</p>
</li><li><p><span><span> 
</span></span>The <b>IpSecPhase</b> field MUST have valid FW_IPSEC_PHASE
values.</p>
</li><li><p><span><span> 
</span></span>If <b>IpSecPhase</b> is FW_IPSEC_PHASE_1:</p>
<ul><li><p><span><span>  </span></span>The
<b>wszSetId</b> field MUST NOT have the primary phase 1 authentication set ID
as a prefix.</p>
</li><li><p><span><span>  </span></span>The
authentication set MUST have at least one authentication suite. </p>
</li><li><p><span><span>  </span></span>The
<b>dwNumSuites</b> field MUST agree with the <b>pSuites</b> field.</p>
</li><li><p><span><span>  </span></span>The
authentication suites methods MUST each be either FW_AUTH_METHOD_ANONYMOUS,
FW_AUTH_METHOD_MACHINE_KERB, FW_AUTH_METHOD_MACHINE_NTLM,
FW_AUTH_METHOD_MACHINE_CERT, or FW_AUTH_METHOD_MACHINE_SHKEY.</p>
</li><li><p><span><span>  </span></span>Authentication
suites that have a method other than machine certificate MUST have the <b>wFlags</b>
field of the same suite set to 0.</p>
</li><li><p><span><span>  </span></span>If
the set schema policy version is 0x200, the <b>wFlags</b> field MUST NOT
contain the FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA256 or the
FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA384 flags.</p>
</li><li><p><span><span>  </span></span>The
<b>wFlags</b> field MUST NOT contain both the FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA256
and the FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA384 flags.</p>
</li><li><p><span><span>  </span></span>All
suites that have the FW_AUTH_METHOD_MACHINE_CERT method and a <b>wFlags</b>
field with the FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA256 flag set, MUST be
contiguous. The same applies for those suites that have the
FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA384 flag set, and those suites that have
neither flag set (they default to <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_3f85a24a-f32a-4322-9e99-eba6ae802cd6" data-linktype="relative-path">RSA</a></span> signing).</p>
</li><li><p><span><span>  </span></span>All
such contiguous suites that have a specific signing flag (either none,
ECDSA256, or ECDSA384) MUST have the same value for the
FW_AUTH_SUITE_FLAGS_HEALTH_CERT flag. </p>
</li><li><p><span><span>  </span></span>The
set MUST NOT have more than one suite that has the anonymous method
(FW_AUTH_METHOD_ANONYMOUS), or that has the machine kerb method
(FW_AUTH_METHOD_MACHINE_KERB), or that has the machine ntlm method
(FW_AUTH_METHOD_MACHINE_NTLM), or that has the machine shkey method
(FW_AUTH_METHOD_MACHINE_SHKEY), as defined in section <span><a href="59e71d46-4407-47d2-9cf5-8889fd3a74f2" data-linktype="relative-path">2.2.60</a></span>.<a id="Appendix_A_Target_20"></a><a aria-label="Product behavior note 20" href="1da2ee70-a6ae-4f76-b08f-fdc25c77d8a0#Appendix_A_20" data-linktype="relative-path">&lt;20&gt;</a></p>
</li><li><p><span><span>  </span></span>The
set MUST NOT have a suite that has an NTLM Authentication Protocol method (as
specified in <span><a href="../ms-nlmp/b38c36ed-2804-4868-a9ff-8dd3182128e4" data-linktype="relative-path">[MS-NLMP]</a></span>)
and a suite SHKey method.</p>
</li><li><p><span><span>  </span></span>If
the set has a machine certificate suite that has a <b>wFlags</b> field that
contains the flag FW_AUTH_SUITE_FLAGS_HEALTH_CERT, all machine certificate
method suites in the set MUST also have this flag.</p>
</li><li><p><span><span>  </span></span>If
the set schema policy version is less than 0x214, the set MUST NOT have suites
that contain the FW_AUTH_METHOD_MACHINE_NEGOEX authentication method.</p>
</li></ul></li><li><p><span><span> 
</span></span>If the <b>IpSecPhase</b> is FW_IPSEC_PHASE_2:</p>
<ul><li><p><span><span>  </span></span>The
<b>wszSetId</b> MUST NOT have the primary phase 2 authentication set ID as a
prefix.</p>
</li><li><p><span><span>  </span></span>The
<b>dwNumSuites</b> field MUST agree with the <b>pSuites</b> field.</p>
</li><li><p><span><span>  </span></span>The
authentication suites methods MUST each be one of FW_AUTH_METHOD_ANONYMOUS,
FW_AUTH_METHOD_USER_KERB, FW_AUTH_METHOD_USER_NTLM, FW_AUTH_METHOD_USER_CERT,
or FW_AUTH_METHOD_MACHINE_CERT.</p>
</li><li><p><span><span>  </span></span>The
set MUST NOT have a suite that has the anonymous method as the only suite.</p>
</li><li><p><span><span>  </span></span>Suites
in the set MUST NOT contain FW_AUTH_SUITE_FLAGS_CERT_EXCLUDE_CA_NAME.</p>
</li><li><p><span><span>  </span></span>Suites
that have user certificate methods MUST NOT contain the
FW_AUTH_SUITE_FLAGS_HEALTH_CERT flag; however, suites that have machine
certificate methods MUST contain it.</p>
</li><li><p><span><span>  </span></span>Authentication
suites that have a method other than machine certificate or user certificate
MUST have the <b>wFlags</b> field of the same suite set to 0. </p>
</li><li><p><span><span>  </span></span>If
the set schema policy version is 0x200, the <b>wFlags</b> field MUST NOT
contain the FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA256 or the
FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA384 flags.</p>
</li><li><p><span><span>  </span></span>The
<b>wFlags</b> field MUST NOT contain both the
FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA256 and the FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA384
flags.</p>
</li><li><p><span><span>  </span></span>All
suites that have a FW_AUTH_METHOD_MACHINE_CERT method and a <b>wFlags</b> field
with the FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA256 flag set, MUST be
contiguous. The same applies to those suites that have the
FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA384 flag set and those suites that have
neither flag set (they default to RSA signing).</p>
</li><li><p><span><span>  </span></span>The
set MUST NOT have more than one suite that has the anonymous method
(FW_AUTH_METHOD_ANONYMOUS), or that has the user kerb method
(FW_AUTH_METHOD_USER_KERB), or that has the user ntlm method
(FW_AUTH_METHOD_USER_NTLM), as defined in section 2.2.60.<a id="Appendix_A_Target_21"></a><a aria-label="Product behavior note 21" href="1da2ee70-a6ae-4f76-b08f-fdc25c77d8a0#Appendix_A_21" data-linktype="relative-path">&lt;21&gt;</a></p>
</li><li><p><span><span>  </span></span>A
set that contains a suite that has the machine certificate method MUST NOT
contain suites that have the user certificate method.</p>
</li><li><p><span><span>  </span></span>A
set that contains a suite that has the machine certificate method MUST only
contain suites that have machine certificate or anonymous methods. </p>
</li></ul></li></ul></div>