Re: Determine if IdentityReference is a Security Group

How about SecurityIdentifier.IsAccountSid() ??

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Hi All,

I've been trudging through old posts, but can't seem to find an
answer. This is the 'Effective Permissions' problem. I've seen a lot
of 'You Can't" and "Do it Using PInvoke/Windows API". I'd like to stay
with a C# solution. Google is only returning two pages. The pages
returned are more of the question, "Is the user a member of a
group?" [1].
From the files system object (directory or file), I have a collection
of AuthorizationRules. I need place the rules (some hand waiving) into
bins to enforce Windows Security business logic (order of Allow/Deny
and User/Group matters):

DenyUser
DenyGroups
AllowUser
AllowGroups
Allow and Deny are easily obtained from IdentityReference. The Sid is
easily obtained also. However, given an IdentityReference (or SID),
how do I determine if it is a Security Group? In a nushell, I want:

IsSecurityGroup( IdentityReference id ) or
IsSecurityGroup( SecurityIdentifier sid )
WindowsIdentity Class does not offer the function [2]. Given a user,
WindowsIdentity will give me a list of the user's groups. But I do not
need this information.

Thanks,
Jeff
Jeffrey Walton
[1]
http://groups.google.com/groups?hl=en&q=c%23+IdentityReference+group
[2]
http://msdn2.microsoft.com/en-us/library/system.security.principal.win
dowsidentity.aspx



.

Relevant Pages

  • Determine if IdentityReference is a Security Group
    ... bins to enforce Windows Security business logic (order of Allow/Deny ... Allow and Deny are easily obtained from IdentityReference. ... However, given an IdentityReference (or SID), ... WindowsIdentity will give me a list of the user's groups. ...
    (microsoft.public.dotnet.security)
  • Re: Determine if IdentityReference is a Security Group
    ... You need to tell whether a sid is a user account or group, ... Get the Win32Security.dll You can then easily determine the type of sid but, ... bins to enforce Windows Security business logic (order of Allow/Deny ... Allow and Deny are easily obtained from IdentityReference. ...
    (microsoft.public.dotnet.security)
  • Re: Determine if IdentityReference is a Security Group
    ... I think there is a p/invoke you can use to get the type of the SID, ... bins to enforce Windows Security business logic (order of Allow/Deny ... Allow and Deny are easily obtained from IdentityReference. ... WindowsIdentity will give me a list of the user's groups. ...
    (microsoft.public.dotnet.security)
  • Re: WindowsPrinciple.IsInRole not working with cached info
    ... Authenticate your WindowsIdentity ... > this software will be deployed to many domains, so the custom group SID ... >> you code to enforce your security. ... Instead of searching for the Administrator ...
    (microsoft.public.dotnet.security)
  • Re: Security issues with local filesystem caching
    ... bypassed (for instance the op that assigns a security label to an inode ... context if that was the basis of the check. ... the kernel that lasts as long as the cache is in active service. ... but once NFS had a SID, the two would then be the same. ...
    (Linux-Kernel)