給定用戶的SID，如何獲取AD DirectoryEntry？

Question

我在windowsPrincipal.getIdentity（）。getSid（）中將用戶的SID設置爲byte []。我如何從SID獲取活動目錄條目（DirectoryEntry）？

Answer 1

我發現在C＃這個例子

// SID must be in Security Descriptor Description Language (SDDL) format 
    // The PrincipalSearcher can help you here too (result.Sid.ToString()) 
    public void FindByIdentitySid() 
    { 
     UserPrincipal user = UserPrincipal.FindByIdentity(
      adPrincipalContext, 
      IdentityType.Sid, 
      "S-1-5-21-2422933499-3002364838-2613214872-12917"); 
     Console.WriteLine(user.DistinguishedName); 
    } 

轉換到VB.NET：

' SID must be in Security Descriptor Description Language (SDDL) format 
    ' The PrincipalSearcher can help you here too (result.Sid.ToString()) 
    Public Sub FindByIdentitySid() 
     Dim user As UserPrincipal = UserPrincipal.FindByIdentity(adPrincipalContext,  IdentityType.Sid, "S-1-5-21-2422933499-3002364838-2613214872-12917") 
     Console.WriteLine(user.DistinguishedName) 
    End Sub 

顯然，則可以：

dim de as new DirectoryEntry("LDAP://" & user.DistinguishedName) 

要獲得SID = S-1 -5-21- *（對不起VB.NET）

' Convert ObjectSID to a String 

    ' http://social.msdn.microsoft.com/forums/en-US/netfxbcl/thread/57452aab-4b68-4444-aefa-136b387dd06e 

    Dim ADpropSid As Byte() 
    ADpropSid = de.Properties("objectSid").Item(0)  
    ' in my test the byte field looks like this : 01 02 00 00 00 00.......37 02 00 00 
    Dim SID As New System.Security.Principal.SecurityIdentifier(ADpropSid, 0) 

我還沒有測試過C＃或自己使用過轉換後的版本，但已經使用了上面的方法來返回SDDL格式的SID。

Answer 2

這也可以在PowerShell中完成，只要你安裝了.NET 3.5或4.0的（見https://gist.github.com/882528，如果你不默認）

add-type -assemblyname system.directoryservices.accountmanagement 
$adPrincipalContext = 
    New-Object System.DirectoryServices.AccountManagement.PrincipalContext( 
    [System.DirectoryServices.AccountManagement.ContextType]::Domain) 
$user = [system.directoryservices.accountmanagement.userprincipal]::findbyidentity(
    $adPrincipalContext 
    , [System.DirectoryServices.AccountManagement.IdentityType]::Sid 
    , "S-1-5-21-2422933499-3002364838-2613214872-12917") 
$user.DisplayName 
$user.DistinguishedName 

Answer 3

我發現的最簡單的方法是使用LDAP綁定。類似於Nick Giles所說的。在MSDN更多信息

''' <summary> 
''' Gets the DirectoryEntry identified by this SecurityIdentifier. 
''' </summary> 
''' <param name="id">The SecurityIdentifier (SID).</param> 
<System.Runtime.CompilerServices.Extension()> _ 
Public Function GetDirectoryEntry(ByVal id As SecurityIdentifier) As DirectoryEntry 
    Const sidBindingFormat As String = "LDAP://AOT/<SID={0}>" 

    Return New DirectoryEntry(String.Format(sidBindingFormat, id.Value)) 
End Function 

Answer 4

使用SecurityIdentifier類中的SID從字節[]轉換格式的字符串，然後直接綁定到對象：

DirectoryEntry OpenEntry(byte[] sidAsBytes) 
{ 
    var sid = new SecurityIdentifier(sidAsBytes, 0); 

    return new DirectoryEntry(string.Format("LDAP://<SID={0}>", sid.ToString())); 
}