Re: ActiveDirectory group membership in offline profile

Hi

i tried it by my own and find out, that in c# 1.1 it is not possible to
pass a SecurityIdentifier.

in c# 2 it go's!

thx for help!


Dominick Baier schrieb:

of course - you cannot pass in the sid string directly to IsInRole

try this:

static void Main(string[] args)
{
WindowsIdentity id = WindowsIdentity.GetCurrent();
foreach (IdentityReference group in id.Groups)
{
Console.WriteLine(group.Value);
}

WindowsPrincipal p = new WindowsPrincipal(id);

SecurityIdentifier sid = new SecurityIdentifier("some domain
SID shown by whoami");

if (p.IsInRole(sid))
Console.WriteLine("OK");
}

---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com

Hi

thx.

i tried that, when i do that offline and get the sids this the
additional parameter /all

but when i test the code with the sid instead of the name of of the
group it doesn't work, too.

Dominick Baier schrieb:

Hi,

you only have SIDs, no group names - you can easily check that with:

whoami /groups

you will see local groups
and SIDs for domain groups
---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com
Hi

I have written an application in which I am using AD groups to set
the program permissions.

sample code:
System.Security.Principal.WindowsIdentity ident =
System.Security.Principal.WindowsIdentity.GetCurrent();
System.Security.Principal.WindowsPrincipal prin = new
System.Security.Principal.WindowsPrincipal(ident);
System.Threading.Thread.CurrentPrincipal = prin;
if (prin.IsInRole(@"domain\group"))
{
btnUpdate.Visible = true;
}
when the user is not connected to the network, it is possible to log
on because of the user offline profile.

but than the code doesn't work. because the user has no memberships.
I thougth the group membership will be stored in the offline user
profile too.

what can i do to solve that problem?

thx for help.

Tim


.

Relevant Pages

  • Re: ActiveDirectory group membership in offline profile
    ... thx for help! ... SecurityIdentifier sid = new SecurityIdentifier("some domain ... SID shown by whoami"); ... Dominick Baier, DevelopMentor ...
    (microsoft.public.dotnet.security)
  • Re: Reading msexchMasterAccountSid
    ... that field contains a SecurityIdentifier (SID). ... If you are working with .NET 2.0 you can wrap that text in a SecurityIdentifier and call sid.Translate) which translate the SIDs to NT4 account names. ...
    (microsoft.public.exchange2000.development)
  • Re: How do I convert sid retrieved from the AD to SDDL string form
    ... you are converting the sid byteto a string. ... the entry and pass it to the SecurityIdentifier constructor. ... Best regards, ...
    (microsoft.public.dotnet.security)
  • Re: ActiveDirectory group membership in offline profile
    ... of course - you cannot pass in the sid string directly to IsInRole ... WindowsIdentity id = WindowsIdentity.GetCurrent; ... Dominick Baier, DevelopMentor ... on because of the user offline profile. ...
    (microsoft.public.dotnet.security)