Re: Roles in context

From: John M Deal (johndeal_at_necessitysoftware.com)
Date: 11/19/04

  • Next message: Rahul Kumar: "Re: Signed assemblies easily cracked?" 
    Date: Thu, 18 Nov 2004 19:31:04 -0800

    If on the last point you (the original poster) was asking "would having
    a client machine with the same name as a domain give you access to the
    domain resources if you were in the machine's administrator group" the
    answer would be no. The reason for this is that it is not the name of
    the machine, or even the domain for that matter, that gives you access
    to resources it is instead the security identifier (SID) of the logged
    on user which is unique. Also the type of identifier on the machine is
    different than the type on the domain. This is a bit too big a topic to
    get into here but if you are interested in finding out a little about
    how this really works, here's a link to the online version of Keith
    Brown's security book:

    http://pluralsight.com/wiki/default.aspx/Keith.GuideBook.HomePage

    This book is a must read, but you can find out most of what you need to
    know about how security works (from a developer's perspective) in the
    first thirty pages or so. Hope this will help you understand more about
    how this all ties together.

    Have A Better One!

    John M Deal, MCP
    Necessity Software

    richlm wrote:
    > I would normally expect to see groups in AD for each departmental role e.g.
    > "SalesAdministrator", "SalesRep", "AccountsAdministrator",
    > "InventoryAdministrator", etc.
    > You can group these together into a heirarchy in AD, e.g. so that the "VP"
    > role includes all the others.
    > The roles/groups in AD should reflect your business organization.
    >
    > In many scenarios the standard WindowsPrincipal.IsInRole will be sufficient.
    > If not you could use Authorization Manager (AzMan) to manage
    > application-specific roles.
    > AzMan is a component of Windows Server 2003 which can also be installed on
    > XP. Here's a good intro if you're not familiar:
    > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetserv/html/AzManRoles.asp
    >
    > Also look at the "Authorization and Profile Application Block" from
    > Microsoft Patterns and Practices
    > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag/html/authpro.asp
    > This builds on AzMan and it may provide the basis/inspiration for a
    > solution.
    >
    >
    > As for you last question - gaining access to what? The user would
    > presumably need domain admin privileges to add their "new" machine to the
    > domain and gain access to any remote resources.
    >
    >

  • Next message: Rahul Kumar: "Re: Signed assemblies easily cracked?"

    Relevant Pages

    • Organisational aspects in security design
      ... the fundament of IT security. ... assignment of responsibilities through to the distribution of control ... Lack of resources or unsuitable resources ... Rights of admission and of access to hardware and software are applied ...
      (comp.security.misc)
    • Re: Distribution group kept changing
      ... Could be anything, public folders, calendars, folders in a mailbox. ... Trying to locate the resources the group is being applied to could be extremely difficult unless you have a very small deployment or you have scripts that can enumerate through all permissions. ... if a distribution group is being used to secure ANY exchange resource, exchange will security enable the group....with "security enable the group" is what is meant by converting a distribution group to a security group ... These groups we created are distribution groups and for email purposes. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Distribution group kept changing
      ... Trying to locate the resources the group is being applied to could be ... Most likely, which exchange ... exchange will security enable the group....with "security enable the group" ... These groups we created are distribution groups and for email purposes. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Child Domain Structure
      ... the principle reason i presumed a child domain would be suitable is thus. ... the location for the child is actually overseas and although the security of ... users at the remote location and those in the parent domain. ... will require access to resources at both locations and some resource ...
      (microsoft.public.windows.server.active_directory)
    • Re: role, domain, and user based security...
      ... IPrinciple, I am leaning this way but I want to understand ... I don't think AzMan supports direct mapping of users to ... were using Windows security auth with AD, ... >> what Microsoft's security model is setup to handle. ...
      (microsoft.public.dotnet.security)
    Loading