I work on an application that uses DCOM to communicate between what are essentially several peers; in the course of normal use, instances on separate machines serve a variety of objects to one another. Historically, for this to work we have used some magic incantations, chief among which is that on every machine the user must log into an account of the same name (note that these are local accounts; there is no domain available). Obviously, this is an aspect of our user experience that could be improved.
I would like to better understand how DCOM authentication works, but I am having difficulty assembling the whole story from the MSDN documentation for CoInitializeSecurity(), CoSetProxyBlanket(), and the like. Are there any thorough explanations available of how, exactly, DCOM operations are accepted or denied? Books, journals, web, any format is fine.
Programming Windows Security by Keith Brown includes a thorough discussion of DCOM security. I can highly recommend this book.