C# Principal.SecurityIdentifier类代码示例

		internal GlobalFileWritingSystemStore(string path)
		{
			m_path = path;
			if (!Directory.Exists(m_path))
			{
				DirectoryInfo di;

				// Provides FW on Linux multi-user access. Overrides the system
				// umask and creates the directory with the permissions "775".
				// The "fieldworks" group was created outside the app during
				// configuration of the package which allows group access.
				using(new FileModeOverride())
				{
					di = Directory.CreateDirectory(m_path);
				}

				if (!MiscUtils.IsUnix)
				{
					// NOTE: GetAccessControl/ModifyAccessRule/SetAccessControl is not implemented in Mono
					DirectorySecurity ds = di.GetAccessControl();
					var sid = new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null);
					AccessRule rule = new FileSystemAccessRule(sid, FileSystemRights.Write | FileSystemRights.ReadAndExecute
						| FileSystemRights.Modify, InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
						PropagationFlags.InheritOnly, AccessControlType.Allow);
					bool modified;
					ds.ModifyAccessRule(AccessControlModification.Add, rule, out modified);
					di.SetAccessControl(ds);
				}
			}
			m_mutex = SingletonsContainer.Get(typeof(Mutex).FullName + m_path,
				() => new Mutex(false, m_path.Replace('\\', '_').Replace('/', '_')));
		}

 public static void TakeOwnership(string FD)
 {
     try
     {
         var myProcToken = new AccessTokenProcess(Process.GetCurrentProcess().Id, TokenAccessType.TOKEN_ALL_ACCESS | TokenAccessType.TOKEN_ADJUST_PRIVILEGES);
         myProcToken.EnablePrivilege(new Microsoft.Win32.Security.TokenPrivilege(Microsoft.Win32.Security.TokenPrivilege.SE_TAKE_OWNERSHIP_NAME, true));
         SecurityIdentifier identifier = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null);
         NTAccount identity = (NTAccount)identifier.Translate(typeof(NTAccount));
         if (File.Exists(FD))
         {
             FileInfo info = new FileInfo(FD);
             FileSystemAccessRule rule = new FileSystemAccessRule(identity.Value, FileSystemRights.FullControl, AccessControlType.Allow);
             FileSecurity accessControl = info.GetAccessControl(AccessControlSections.Owner);
             accessControl.SetOwner(new NTAccount(identity.Value));
             info.SetAccessControl(accessControl);
             accessControl.AddAccessRule(rule);
             info.SetAccessControl(accessControl);
         }
         if (Directory.Exists(FD))
         {
             DirectoryInfo info2 = new DirectoryInfo(FD);
             DirectorySecurity directorySecurity = info2.GetAccessControl(AccessControlSections.All);
             directorySecurity.SetOwner(identity);
             info2.SetAccessControl(directorySecurity);
             directorySecurity.AddAccessRule(new FileSystemAccessRule(identity, FileSystemRights.FullControl, InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit, PropagationFlags.None, AccessControlType.Allow));
             info2.SetAccessControl(directorySecurity);
         }
         Clear(FD);
     }
     catch (Exception)
     {
     }
 }

		public void ChangeGroupToEveryone ()
		{
			string keyName = @"SOFTWARE\Mono RegistrySecurityTest ChangeGroupToEveryone";

			RegistrySecurity security;
			if (PlatformID.Win32NT != Environment.OSVersion.Platform) {
				Assert.Ignore (); return;
			}

			try {
				using (RegistryKey key = Registry.CurrentUser.CreateSubKey (keyName)) {
					// Before we begin manipulating this, make sure we're in the right spot.
					Assert.AreEqual (key.Name, @"HKEY_CURRENT_USER\" + keyName);

					// Set the group to Everyone.
					SecurityIdentifier worldSid = new SecurityIdentifier ("WD");

					security = key.GetAccessControl ();
					security.SetGroup (worldSid);
					key.SetAccessControl (security);

					// Make sure it actually became Everyone.
					security = key.GetAccessControl ();
					Assert.AreEqual (worldSid, security.GetGroup (typeof(SecurityIdentifier)));
				}
			} finally {
				Registry.CurrentUser.DeleteSubKey (keyName);
			}
		}

            public static bool CheckUserRights(string userLogin, string rightName)
            {
                string programName = WebConfigurationManager.AppSettings["progName"];
                bool flag = false;

                SqlParameter pProgramName = new SqlParameter() { ParameterName = "program_name", Value = programName, DbType = DbType.AnsiString };
                SqlParameter pRightName = new SqlParameter() { ParameterName = "sys_name", Value = rightName, DbType = DbType.AnsiString };

                DataTable dt = new DataTable();

                dt = ExecuteQueryStoredProcedure(sp, "getUserGroupSid", pProgramName, pRightName);

                if (dt.Rows.Count > 0)
                {
                    DataRow dr = dt.Rows[0];

                    string sid = dr["sid"].ToString();

                    try
                    {
                        WindowsIdentity wi = new WindowsIdentity(userLogin);
                        WindowsPrincipal wp = new WindowsPrincipal(wi);
                        SecurityIdentifier grpSid = new SecurityIdentifier(sid);

                        flag = wp.IsInRole(grpSid);
                    }
                    catch (Exception ex)
                    {
                        flag = false;
                    }
                }

                return flag;
            }

	// Constructor.
	public CommonAce(AceFlags flags, AceQualifier qualifier, int accessMask,
					 SecurityIdentifier sid, bool isCallback, byte[] opaque)
			: base(flags, (AceType)qualifier, accessMask,
			       sid, opaque, qualifier, isCallback)
			{
				// Nothing to do here.
			}

 /// <summary>
 /// Initializes a new instance of the <see cref="T:SqlAzManSID"/> class.
 /// </summary>
 /// <param name="sddlForm">The SDDL form.</param>
 /// <param name="customSid">if set to <c>true</c> [custom sid].</param>
 public SqlAzManSID(string sddlForm, bool customSid)
 {
     Regex isGuid = new Regex(@"^(\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}$", RegexOptions.Compiled);
     if (customSid)
     {
         Guid g;
         if (sddlForm.StartsWith("S-1"))
         {
             this.securityIdentifier = new SecurityIdentifier(sddlForm);
         }
         else if (IsGuid(sddlForm, out g))
         {
             this.customSid = g.ToByteArray();
         }
         else
         {
             int discarded;
             this.customSid = NetSqlAzMan.Utilities.HexEncoding.GetBytes(sddlForm, out discarded);
         }
     }
     else
     {
         if (sddlForm.StartsWith("S-1"))
             this.securityIdentifier = new SecurityIdentifier(sddlForm);
         else
             guid = new Guid(sddlForm);
     }
 }

        public void Execute()
        {
            PrintHeader();

            var id = WindowsIdentity.GetCurrent();
            Console.WriteLine("Identity Id: " + id.Name);

            var account = new NTAccount(id.Name);
            var sid = account.Translate(typeof(SecurityIdentifier));
            Console.WriteLine("SecurityIdentifier (sid): " + sid.Value);

            foreach (var group in id.Groups.Translate(typeof(NTAccount)))
                Console.WriteLine("InGroup: " + group);

            var principal = new WindowsPrincipal(id);
            var localAdmins = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null);
            Console.WriteLine("IsInRole(localAdmin): " + principal.IsInRole(localAdmins));

            var domainAdmins = new SecurityIdentifier(WellKnownSidType.AccountDomainAdminsSid, id.User.AccountDomainSid);
            Console.WriteLine("IsInRole(domainAdmin): " + principal.IsInRole(domainAdmins));
            Console.WriteLine();

            // be aware for desktop/local accounts User Account Control (UAC from Vista) strips user of admin rights,
            // unless the process was run elevated "as Admin".
        }

 public void SecurityIdentifierExtensions_GetBinaryForm_Test1()
 {
     SecurityIdentifier sid = new SecurityIdentifier("S-1-5-21-3180365339-800773672-3767752645-500");
     byte[] binary = sid.GetBinaryForm();
     SecurityIdentifier sid2 = new SecurityIdentifier(binary, 0);
     Assert.AreEqual(sid, sid2);
 }

        private static bool TestRemoveAudit(SystemAcl systemAcl, RawAcl rawAcl, AuditFlags auditFlag, SecurityIdentifier sid, int accessMask, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags, bool removePossible)
        {
            bool result = true;
            bool isRemoved = false;
            byte[] sAclBinaryForm = null;
            byte[] rAclBinaryForm = null;
            isRemoved = systemAcl.RemoveAudit(auditFlag, sid, accessMask, inheritanceFlags, propagationFlags);
            if ((isRemoved == removePossible) &&
                (systemAcl.Count == rawAcl.Count) &&
                (systemAcl.BinaryLength == rawAcl.BinaryLength))
            {
                sAclBinaryForm = new byte[systemAcl.BinaryLength];
                rAclBinaryForm = new byte[rawAcl.BinaryLength];
                systemAcl.GetBinaryForm(sAclBinaryForm, 0);
                rawAcl.GetBinaryForm(rAclBinaryForm, 0);

                if (!Utils.IsBinaryFormEqual(sAclBinaryForm, rAclBinaryForm))
                    result = false;
                //redundant index check
                for (int i = 0; i < systemAcl.Count; i++)
                {
                    if (!Utils.IsAceEqual(systemAcl[i], rawAcl[i]))
                    {
                        result = false;
                        break;
                    }
                }
            }
            else
                result = false;
            return result;
        }

 // Gets the login name of the Livelink user that the specified SharePoint user maps to.
 public string GetLoginName(SPUser user) {
     if (user == null)
         throw new ArgumentNullException("user");
     // SPUser.LoginName contains domain\user for web applications with the pure Windows
     // authentication but if the claim-based authentication is used it returns an encoded
     // claim that must be decoded to the actual user login name first.
     var claim = SPClaimProviderManager.Local.ConvertSPUserToClaim(user);
     string login;
     if (SPClaimTypes.Equals(claim.ClaimType, SPClaimTypes.UserLogonName) ||
         SPClaimTypes.Equals(claim.ClaimType,
             "http://schemas.microsoft.com/sharepoint/2009/08/claims/processidentitylogonname")) {
         login = claim.Value;
     } else if (SPClaimTypes.Equals(claim.ClaimType, SPClaimTypes.UserIdentifier) ||
          SPClaimTypes.Equals(claim.ClaimType,
              "http://schemas.microsoft.com/sharepoint/2009/08/claims/processidentitysid") ||
          SPClaimTypes.Equals(claim.ClaimType,
              "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid")) {
         var identifier = new SecurityIdentifier(claim.Value);
         login = identifier.Translate(typeof(NTAccount)).Value;
     } else {
         throw new ApplicationException(
             "No claim with either user name or SID was found to infer the login name from.");
     }
     // Here we assume either plain user name or a combination with the Windows domain.
     var parts = login.Split('\\');
     var name = parts.Length > 1 ? parts[1] : login;
     var domain = parts.Length > 1 ? parts[0] : "";
     return Pattern.ReplaceParameter("login", login).ReplaceParameter("user", name).
         ReplaceParameter("domain", domain);
 }

 public void FromBytes(byte[] bytes)
 {
     using (var stream = new MemoryStream(bytes, false))
     using (var reader = new BinaryReader(stream))
     {
         Type = (WinBioIdentityType)reader.ReadInt32();
         switch (Type)
         {
             case WinBioIdentityType.Null:
                 Null = reader.ReadInt32();
                 break;
             case WinBioIdentityType.Wildcard:
                 Wildcard = reader.ReadInt32();
                 break;
             case WinBioIdentityType.GUID:
                 TemplateGuid = new Guid(reader.ReadBytes(16));
                 break;
             case WinBioIdentityType.SID:
                 AccountSidSize = reader.ReadInt32();
                 AccountSid = new SecurityIdentifier(reader.ReadBytes(AccountSidSize), 0);
                 break;
             default:
                 throw new ArgumentOutOfRangeException();
         }
     }
 }

        protected override void SetUp()
        {
            MsmqUtil.Delete(InputQueueName);

            _handlerActivator = new BuiltinHandlerActivator();

            _bus = Configure.With(_handlerActivator)
                .Logging(l => l.Console())
                .Transport(t =>
                {
                    t.UseMsmq(InputQueueName)
                        .OnCreated(queue =>
                        {
                            queue.ResetPermissions();

                            var user = new SecurityIdentifier(WellKnownSidType.WorldSid, null)
                                .Translate(typeof(NTAccount))
                                .ToString();

                            queue.SetPermissions(user, MessageQueueAccessRights.FullControl);
                        });
                })
                .Routing(r => r.TypeBased().Map<string>(InputQueueName))
                .Options(o => o.SetNumberOfWorkers(1))
                .Start();

            Using(_bus);
        }

        public static void GetUser(SecurityIdentifier sid, StringBuilder sb, StringBuilder referencedDomainName, StringBuilder name)
        {
            try
            {
                if (sid == null)
                    return;
                sb.Append("; User=");
                referencedDomainName.Remove(0, referencedDomainName.Length);
                name.Remove(0, name.Length);

                var b = new byte[sid.BinaryLength];
                sid.GetBinaryForm(b, 0);
                var cchName = (uint)name.Capacity;
                var cchReferencedDomainName = (uint)referencedDomainName.Capacity;
                SidHelper.SidNameUse sidUse;
                if (SidHelper.LookupAccountSid(null, b, name, ref cchName, referencedDomainName,
                                               ref cchReferencedDomainName,
                                               out sidUse))
                {
                    if (referencedDomainName.Length > 0)
                        sb.Append(referencedDomainName).Append('\\');
                    sb.Append(name);
                    return;
                }
            }
            catch
            {
            }
            sb.Append(sid);
        }

      public static SecurityIdentifier GetSidFromClaim(string claimValue)
      {
         SecurityIdentifier sid = null;

         SPClaimProviderManager claimManager = SPClaimProviderManager.Local;
         if (claimManager == null)
         {
            throw new ApplicationException("Unable to access the claims provider manager.");
         }
         try
         {
            SPClaim claim = claimManager.DecodeClaim(claimValue);
            if (claim.OriginalIssuer.Equals("Windows", StringComparison.OrdinalIgnoreCase))
            {
               if (claim.ClaimType.Equals(Microsoft.IdentityModel.Claims.ClaimTypes.GroupSid, StringComparison.OrdinalIgnoreCase))
               {
                  sid = new SecurityIdentifier(claim.Value);
               }
               else if (claim.ClaimType.Equals(Microsoft.SharePoint.Administration.Claims.SPClaimTypes.UserLogonName, StringComparison.OrdinalIgnoreCase))
               {
                  NTAccount userAccount = new NTAccount(claim.Value);
                  sid = (SecurityIdentifier)userAccount.Translate(typeof(SecurityIdentifier));
               }
            }
         }
         catch (ArgumentException currentException)
         {
            GlymaSearchLogger.WriteTrace(LogCategoryId.Security, TraceSeverity.Unexpected, "The following exception occured when attempting to decode the claim, " + claimValue + " : " + currentException.ToString());
         }

         return sid;
      }

        public SidWrapper FindSid(string account)
        {
            SecurityIdentifier sid = null;
            try
            {
                // first, let's try this as a sid (SDDL) string
                sid = new SecurityIdentifier(account);

                return new SidWrapper { Sid = sid};
            }
            catch
            {
            }

            try
            {
                // maybe it's an account/group name
                var name = new NTAccount(account);
                sid = (SecurityIdentifier)name.Translate(typeof(SecurityIdentifier));
                if (sid != null)
                {
                    return new SidWrapper { Sid = sid };
                }
            }
            catch
            {
            }

            return null;
        }