Weird problem with SSPI

[Kasparov]

I am facing a weird problem. Any pointers are much appreciated.

I am using SSPI for authentication on Windows 2003 machine. On my
server side I am checking whether my SSPI context user is part of the
backup operators (BO) group. Now the check always returns me false
even though the user is present in the BO group on that machine.

Strange thing is if I do logonuser using the same username and
password (with which the client is running) on the server side and try
to check whether the logon user token is part of the BO group it
returns me TRUE ! Have also tried with administrator group but there
the functionality is as expected (both the times it returns me true) .
So I am not sure whats going on. I am pasting part of my code below:

**************
// At this point SSPI handshake is complete.
AcceptSecurityContext has returned 0.

// Initialise SID for the Backup Operators group
if ( AllocateAndInitializeSid( &NtAuthority,
2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_BACKUP_OPS,
0, 0, 0, 0, 0, 0,
&BOGroup ) == 0)
{
ret_val = GetLastError()
break
}


// Impersonate the context
ss = (*c->ImpersonateSecurityContext)(&c->hContext)
if (!SEC_SUCCESS(ss))
{
ret_val = E_CORBA_AUTH_FAILURE
break
}

// Fetch username with domain name from the SSPI context

HANDLE hToken = NULL
PTOKEN_USER ptiUser = NULL
DWORD cbti = 0
SID_NAME_USE snu



// Check group permissions

if (!CheckTokenMembership( NULL, BOGroup, &bIsMember)) //
Check whether part of the BO group
{
ret_val = GetLastError()
break
}
if (bIsMember)
{
sspiContext.isBO = true
}
else
{
}


// Do Logon user with the same credentials and impersonate to
fetch the access token
// here NDMPContext.username and password are of the same user
as obtained from SSPI context.

LogonAndImpersonateUser( (const CHAR *)
(ndmpContext.username).c_str(), (const CHAR *)
(ndmpContext.passsword).c_str() )


if (!CheckTokenMembership( NULL, BOGroup, &bIsMember))
{
BE_Zprintf(0, TEXT("checkGroupMembership:
CheckTokenMembership returned %d\n"), GetLastError() )
}
if ( ndmpContext.isAnonymous || ( !ndmpContext.isAdmin && !
ndmpContext.isBO ))
{
BE_Zprintf( 0, TEXT( "SSPIAuthenticate: Authenticating
user is ANONYMOUS or not part of the administrator / BO group.
Rejecting..." ))
ret_val = E_CORBA_AUTH_FAILURE
break
}


**************


Thanks in advance,
Ganesh Tambat