Active Directory. Work with DACL

本文关键字：DACL with Work Directory Active | 更新日期: 2023-09-27 18:21:55

我正在尝试创建自己的静态类来使用AD。我写了一个静态方法：

    public static void AddReadingAceForGroup(DirectoryEntry dirEntry, string groupName)
    {
        dirEntry.RefreshCache();
        DirectoryEntry root = new DirectoryEntry("LDAP://192.168.1.1/       dc=mydomain,dc=ru");
        using (DirectorySearcher ds = new DirectorySearcher(root, "CN="+groupName))
        {
            SearchResult sr = ds.FindOne();
            root = sr.GetDirectoryEntry();
        }
        try
        {
            ActiveDirectoryAccessRule accessRule =
                new ActiveDirectoryAccessRule(root.ObjectSecurity.GetGroup(typeof(SecurityIdentifier)),
                                              ActiveDirectoryRights.GenericRead, AccessControlType.Allow);
            dirEntry.ObjectSecurity.AddAccessRule(accessRule);
            dirEntry.CommitChanges();
        }
        catch(Exception e)
        {
        }
    }

在使用此函数之前，我确实用远程凭据模拟用户，然后代码正常工作，但没有结果。删除ACE的类似功能运行良好。

Active Directory. Work with DACL

最终的工作代码是：

public static SecurityIdentifier GetGroupSid(string groupName, string domainControllerIp)
{
    SecurityIdentifier sid = null;
    using (PrincipalContext dcx = new PrincipalContext(ContextType.Domain, domainControllerIp))
    {
        GroupPrincipal group = GroupPrincipal.FindByIdentity(dcx, groupName);
        if (group != null)
        {
            sid = group.Sid;
            group.Dispose();
        }
    }
    return sid;
}
public static void AddDaclsAceForGroup(DirectoryEntry dirEntry, string groupName, string ip)
{
    SecurityIdentifier sid = GetGroupSid(groupName,ip);
    try
    {
        ActiveDirectoryAccessRule accessRule =
            new ActiveDirectoryAccessRule(sid,ActiveDirectoryRights.GenericRead, AccessControlType.Allow);
        dirEntry.ObjectSecurity.AddAccessRule(accessRule);
        dirEntry.CommitChanges();
    }
    catch(Exception e)
    {
    }
}

我刚刚在组SID上出现错误。代码运行得很完美，但这不是我所期望的。对不起，我的英语不好。

相关文章：