Click here to Skip to main content
15,867,488 members
Articles / Programming Languages / C#
Article

NT Security Classes for .NET

Rate me:
Please Sign up or sign in to vote.
4.78/5 (33 votes)
19 Feb 2004CPOL2 min read 375.7K   3.9K   75   103
A collection of .NET classes written in Managed C++ that faciliate the manipulation of NT security rights

Introduction

This class library allows access to the Win32 security calls in a .NET friendly way. It encapsulates the concepts of a user, a securable object (like a file, named pipe, directory, etc.), and permissions. This library was written in Managed C++ to simplify the amount of work needed to link to existing Win32 libraries. However, since it exposes all of its functionality via .NET, it can be used from any .NET compliant language, including C# and Visual Basic. The project was written and compiled with Visual Studio 2002.

NOTE: There is a library written by some Microsoft guys on GotDotNet that does much of the same thing and more. It can be found at http://www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=e6098575-dda0-48b8-9abf-e0705af065d9.

This article outlines the primary objects in the library and their use in manipulating security objects.

Documentation

WindowsUser class

This class represents a single Windows identity (SID). It can be created by specifying either a username ("DOMAIN\user" format) or the string representation of a SID ("S-1-5-xxxx-xxx..."). You can also get the identity of the current user using the static property CurrentUser.

There are a number of predefined identities that exist as static members of a child class called WellKnownIdentities. Once you have an identity, you can get the following properties:

  • AccountName: string name of the account
  • Domain: string name of the account's domain
  • FullName: string in the form of "Domain\AccountName"
  • SidString: string representation of the SID

SecuredObject class

This class represents an object which can have a security descriptor. It can be created by specifying the name of the resource along with its type or by passing a handle (as an IntPtr) to the resource.

Once you have the object, you can update the permissions, audit information, owner and group.

PermissionsList

This class encapsulates actions on the ACL. It allows granting, revoking, changing, and denying access levels to different users. Derived from AccessList, which is a collection class for AccessEntry.

AuditingList

This class encapsulates actions on the auditing list of an object. It allows getting and setting audit success and failure rights. Derived from

AccessList
, which is a collection class for AccessEntry.

AccessEntry

This class encapsulates the Access Control Entry or ACE. You can set the user (trustee) and the associated rights and inheritance.

Example

This code shows the library in action. It assumes you have aliased the Microsoft.Win32.Security namespace (using in C#, Imports in VB).

C#
// Get the current user and print their information
WindowsUser user = WindowsUser.CurrentUser;
Console.WriteLine("{0} ({1})", user.FullName, user.SidString);

// Get the current user from their token
WindowsUser duser = new WindowsUser(
  System.Security.Principal.WindowsIdentity.GetCurrent().Token);
Console.WriteLine(duser.FullName);

// Compare users
if (user == duser)
   Console.WriteLine("Same");
else
   Console.WriteLine("Different");

// Get a well-known user
user = WindowsUser.WellKnownIdentities.World;
Console.WriteLine(user.FullName);

// Get a user by name from a specific server (usually a domain controller)
WindowsUser kuser = new WindowsUser("user2", @"\\MYPDC");
Console.WriteLine(kuser.FullName);

// Get a user by name
user = new WindowsUser("DOMAIN\\user3");
Console.WriteLine(user.FullName);

// Get a user by SID
user = new WindowsUser("S-1-5-21-21782756-1035017279-1439700725-1111");
Console.WriteLine(user.FullName);

// Get security for C:\ directory
SecuredObject sec = new SecuredObject("C:\\", SecuredObjectType.FileObject);
DumpObject(sec);

// Set some various permissions on the directory
sec.Permissions.SetAccess(kuser, AccessRights.FileRead,
   AceInheritanceFlags.ContainerInherit|AceInheritanceFlags.ObjectInherit);
sec.Permissions.GrantAccess(kuser, AccessRights.FileExecute,
   AceInheritanceFlags.ContainerInherit|AceInheritanceFlags.ObjectInherit);
sec.Permissions.DenyAccess(kuser, AccessRights.FileWriteUnsync,
   AceInheritanceFlags.ContainerInherit|AceInheritanceFlags.ObjectInherit);
WindowsUser owner = sec.Owner;
sec.Owner = duser;
sec.Auditing.SetAuditFailure(duser, AccessRights.FileReadUnsync,
   AceInheritanceFlags.ContainerInherit|AceInheritanceFlags.ObjectInherit);
DumpObject(sec);

// Revoke some access
sec.Permissions.RevokeAccess(kuser);
sec.Owner = owner;
DumpObject(sec) ;

// Reset the security on the directory
sec.Permissions.Clear();
sec.Permissions.InheritFromParent = true;
DumpObject(sec);

// Write the DACL using the Microsoft style
Console.WriteLine(sec.ToString());

The following function shows how to enumerate the permissions on a security object.

C#
static void DumpObject(SecuredObject sec)
{
   Console.WriteLine("Security description:");
   Console.WriteLine("=====================");
   Console.WriteLine("Owner: {0}\nGroup: {1}", 
     sec.Owner.FullName, sec.Group.FullName);
   Console.WriteLine("Permissions:");
   foreach (AccessEntry ace in sec.Permissions)
      Console.WriteLine(String.Format("  {0} : {1} : {2}", 
         ace.Trustee.FullName,
         ace.Inheritance, ace.Rights));
   Console.WriteLine("Auditing:");
   foreach (AccessEntry ace in sec.Auditing)
      Console.WriteLine(String.Format("  {0} : {1} : {2}", 
         ace.Trustee.FullName,
         ace.Inheritance, ace.Rights));
}

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Chief Technology Officer
United States United States
I have been a Windows software developer since 1991. Most of what I create fills the need for some aspect of bigger projects that I consult on.

Comments and Discussions

 
GeneralRe: unverifiable assembly.... Pin
mpemberton3-Jul-03 7:38
mpemberton3-Jul-03 7:38 
GeneralRe: unverifiable assembly.... Pin
Benyke15-Jan-05 23:35
Benyke15-Jan-05 23:35 
GeneralProblem getting HKLM permissions Pin
Steve021219-May-03 15:27
Steve021219-May-03 15:27 
GeneralRe: Problem getting HKLM permissions Pin
David Hall20-May-03 6:29
professionalDavid Hall20-May-03 6:29 
GeneralRe: Problem getting HKLM permissions Pin
Steve021220-May-03 13:57
Steve021220-May-03 13:57 
GeneralSecurity Classes from Microsoft Pin
David Hall6-Mar-03 5:54
professionalDavid Hall6-Mar-03 5:54 
QuestionCan anyone help me? Pin
parkman5-Mar-03 8:46
parkman5-Mar-03 8:46 
AnswerRe: Can anyone help me? Pin
David Hall6-Mar-03 5:38
professionalDavid Hall6-Mar-03 5:38 
GeneralBuilding .NET project correctly Pin
parkman4-Mar-03 8:11
parkman4-Mar-03 8:11 
GeneralUsing this module in commercial code Pin
Steve021220-Feb-03 15:41
Steve021220-Feb-03 15:41 
GeneralRe: Using this module in commercial code Pin
leppie20-Feb-03 15:59
leppie20-Feb-03 15:59 
GeneralUnable to load file 'mmsseclib' Pin
CliffeH6-Feb-03 10:07
CliffeH6-Feb-03 10:07 
GeneralOh, and one more thing... Pin
CliffeH6-Feb-03 10:37
CliffeH6-Feb-03 10:37 
GeneralRe: Oh, and one more thing... Pin
criZasher6-Feb-03 10:46
criZasher6-Feb-03 10:46 
GeneralPerfect Pin
pburns19-Nov-02 15:30
pburns19-Nov-02 15:30 
Questionregistrykey securedobject? Pin
groovyponens6-Oct-02 22:54
groovyponens6-Oct-02 22:54 
AnswerRe: registrykey securedobject? Pin
groovyponens6-Oct-02 23:29
groovyponens6-Oct-02 23:29 
GeneralACCESS_MASK Pin
Mazdak19-Sep-02 3:34
Mazdak19-Sep-02 3:34 
GeneralOwners! Pin
Mazdak19-Sep-02 2:18
Mazdak19-Sep-02 2:18 
GeneralInheritence of permssions Pin
Syborg7712-Sep-02 21:13
Syborg7712-Sep-02 21:13 
GeneralRe: Inheritence of permssions Pin
Pierrick17-Sep-02 5:43
Pierrick17-Sep-02 5:43 
GeneralRe: Inheritence of permssions Pin
Syborg7717-Sep-02 20:43
Syborg7717-Sep-02 20:43 
GeneralRe: Inheritence of permssions Pin
Pierrick17-Sep-02 23:00
Pierrick17-Sep-02 23:00 
GeneralRe: Inheritence of permssions Pin
Syborg7718-Sep-02 21:06
Syborg7718-Sep-02 21:06 
GeneralRe: Inheritence of permssions Pin
Pierrick19-Sep-02 6:18
Pierrick19-Sep-02 6:18 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.