Access Control List in C# 2.0

• Download source files - 47 Kb

Introduction

I have created a ACL Viewer utility which does the following:

1. Resolve Sid in current domain and trusted domains only. Currently It does not resolve in the forest and few well-know sids.

2. Show all the permissions assigned to a Trustee.

3. Show inheritance information

4. Resolve all the object-guids ==> property, property-set and object types

MS has developed a very good architecture to get the data from Active Directory in .NET. However I did not found a good document on the same. I did some RnD and created an ACL viewer which I required to test my effective permission algorithm.

I will talk about effective permission in my next article. This is just the beginning for permission in active directory.

Algorithm:

Input:
1. LDAP path of the Object
2. Credentials => UserName and Password

Output:
List all the permissions assigned on the give object

Algorithm:
1. Bind to the object using the credentials ==> Use DirectoryEntry class for this
2. Get the security information from the object ==> Use ActiveDirectorySecurity class for this
3. Get the Security Descriptor from the security information ==> In SDDL format (basically its a string format)
4. Get all the access rules, access control entries ==> Use AuthorizationRuleCollection class for this
5. For each rule, resolve the SID and object-Type
6. Display all the entries to the user.

Code

DirectoryEntry objDE = new DirectoryEntry(adPath, credUser, credPassword);

ActiveDirectorySecurity adSecurity = objDE.ObjectSecurity;

string sd = adSecurity.GetSecurityDescriptorSddlForm(AccessControlSections.All);

AuthorizationRuleCollection rules = adSecurity.GetAccessRules(true, true, typeof(NTAccount);

NTAccount class resolves SIDs in the current domain. I have use ::LookupAccountSid to resolve SIDs in trusted domains and to resolve Well-Known SIDs.

To resolve Object-Types I am getting all the object-types from the active directory and caching it. The code is really simple and you can figure is out very easily.

Still if you have problems please contact me at SumitKJain@hotmail.com