MORE INFORMATION
The SID for a trustee is stored in binary form on the ACL. The binary SID is not human-readable.
The IADsAccessControlEntry interface enables directory clients to access and manipulate individual access control entries (ACEs) of the object. IADsAccessControlEntry attempts to convert the trustee's binary SID into a more human-readable form by using the
LookupAccountSID function.
LookupAccountSID can be executed remotely. In this case, it is executed on the local system. The
LookupAccountSID API will search all of the trusted domains and return the domain and userID for the trustee's SID. However, in this scenario, the trustee is stored in the untrusted remote workstation's SAM. The LookupAccountSID API will fail to resolve the binary SID. When the API fails, the trustee is converted into the SDDL form and placed in the
IADsAccessControlEntry::Trustee property.
The process for converting the SDDL form of the SID into a binary SID, which can then be used in a call to the
LookupAccountSid API to return the SAM account name form is as follows:
- Parse the SDDL form of the SID found in the IADsAccessControlEntry::Trustee property so that the issuing authority and the subauthority relative identifiers (RIDs) can be determined.
- Initialize a binary SID with the appropriate number of subauthorities.
- Build the binary SID by adding the appropriate subauthorities in the proper order.
- Use the newly created binary SID in a LookupAccountSid call targeting the local computer were the SDDL SID was obtained.
Sample code
This section contains Microsoft Visual Basic and Microsoft Visual C++ source code to convert a SDDL SID into a SAM account name.
Visual Basic code
' This code is meant to be used as an example of how one could convert
' the SDDL form of a SID into the SAM Account Name form.
' The class module defines two functions,
' ConvertSDDLtoSam which takes an SDDL form of a SID along with a target server
' and returns the Domain\user (SAM Account Name ) form of the SID.
'
' GetSubAuthorityFromSDDL, a helper function that walks the sub authorities.
'
Option Explicit
Private SidCount As Integer
Private Osid As New ADsSID
Const LMEM_ZEROINIT = &H40
'
' Declare the APIs needed to manipulate the binary SID
'
Private Declare Function InitializeSid Lib "advapi32.dll" (ByVal Sid As Long, pIndentifierAuthority As Any, ByVal nSubAuthorityCount As Byte) As Long
Private Declare Function GetSidSubAuthority Lib "advapi32.dll" (ByVal Sid As Long, ByVal nSubAuthority As Long) As Long
Private Declare Function GetSidLengthRequired Lib "advapi32.dll" (ByVal nSubAuthorityCount As Byte) As Long
Private Declare Function LookupAccountSid Lib "advapi32.dll" Alias "LookupAccountSidA" _
(ByVal lpSystemName As String, Sid As Any, ByVal name As String, cbName As Long, _
ByVal ReferencedDomainName As String, cbReferencedDomainName As Long, peUse As Integer) As Long
'
' Declare the memory management functions.
' Notice there are two definitions for RtlMoveMemory,
' one takes a value as Any, the other takes a value ByVal as long
' this is necessary so memory can be copied as follows:
' From a variable containing a 32 bit value that represents a memory location
' From a variable that represents a VB allocated memory location
' (ie: Dim bByte(6) as Byte type of declaration).
'
' LocalAlloc and LocalFree are used to allocate and free memory from the heap,
'respectively.
'
Private Declare Sub CopyByValMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, ByVal Source As Long, ByVal Length As Long)
Private Declare Sub CopyByRefMemory Lib "kernel32" Alias "RtlMoveMemory" (ByVal Destination As Long, Source As Any, ByVal Length As Long)
Private Declare Function LocalAlloc Lib "kernel32" (ByVal wFlags As Long, ByVal wBytes As Long) As Long
Private Declare Function LocalFree Lib "kernel32" (ByVal hMem As Long) As Long
Private Declare Function ConvertStringSidToSid Lib "advapi32.dll" Alias "ConvertStringSidToSidA" (ByVal StringSid As String, ByRef pSID As Long) As Boolean
'
' ConvertSDDLtoSAM, see above comments for a description.
'
Public Function ConvertSDDLtoSAM(strSDDL As String, Target As String) As String
Dim stInt As Integer, strEnd As Integer
Dim iEndPosition As Integer, AuthorityCount As Integer
Dim AuthorityStrings(15) As String
Dim Authority As String, lngSSubAuthority As Long
Dim mByte() As Byte, str As String
Dim lngSid As Long, clssid As Long
Dim One As Integer, bRelValue As Long
Dim strUser As String * 255, strDomain As String * 255
Dim Retval As Integer, Counter As Integer
Dim lngRid As Long, cbSidLength As Long
Dim bIdentifier(1 To 6) As Byte
'
' Fill the AuthorityStrings array with the appropriate values.
' AuthorityStrings(1) - The SID revision level
' AuthroityStrings(2) - The issuing authority
' AuthorityStrings(3) - 0th sub authority RID
' .
' .
' .
' AuthorityStrings(n) - Nth sub authority RID
'
AuthorityCount = 1
Authority = GetSubAthorityFromSDDL(strSDDL, 1, iEndPosition)
AuthorityStrings(AuthorityCount) = Authority
'
' Walk the rest of the sub authorities and place them into
' the string array
'
Do
Authority = GetSubAthorityFromSDDL(strSDDL, iEndPosition, iEndPosition)
If (Len(Authority) > 0) Then
AuthorityCount = AuthorityCount + 1
AuthorityStrings(AuthorityCount) = Authority
End If
Loop While (iEndPosition > 0)
'
' Initialize the security identifier. AuthorityCount - 2 should be total
' number of sub authorities that need to be added to the
' the SID. Use InitializeSid to create a SID using the proper authority (stored
' in the second location of AuthorityStrings) and add the appropriate number of sub
' authorities.
'
' Retrieve the SubAuthority count
'
Retval = CInt(AuthorityStrings(2))
'
' Place that value into the appropriate Identifier array position.
' Just by coincidence, the Issuing Authority array and the
' issuing authority portion of the SDDL SID are the same number, so
' the structure ends up 0,0,0,0,0,CInt(AuthorityStrings(2))
'
bIdentifier(6) = Retval
'
' Get a total SubAuthority count
'
SidCount = AuthorityCount - 2
'
' Retrieve the overall required size for the sid
' We must know how many bytes will be needed to build the binary
' sid, GetSidLengthRequired will return that information
'
cbSidLength = GetSidLengthRequired(SidCount)
ReDim mByte(cbSidLength)
'
' Allocate Memory for the binary SID
'
clssid = LocalAlloc(LMEM_ZEROINIT, cbSidLength)
'
' Its time to Initialize the SID.
' Call InitializeSid to populate sid buffer. InitializeSid
' properly initializes the issuing authority and revision sections
' of the binary sid
'
lngSid = InitializeSid(clssid, bIdentifier(1), SidCount)
'
' Build the binary sid using GetSidSubAuthoriy API. The API
' returns an pointer to the location for the Sub Authority rid.
' Sub authority RIDs are stored in location 3 - AuthorityCount
' in the AuthorityStrings array. Simply convert the string form of
' the RID into a long and copy the memory into the pointer returned
' by GetSidSubAuthority
'
For Counter = 3 To AuthorityCount
lngSSubAuthority = GetSidSubAuthority(clssid, Counter - 3)
If val(AuthorityStrings(Counter))<2147483648# Then
lngRid = CLng(AuthorityStrings(Counter))
Else
lngRid = val(AuthorityStrings(Counter)) - 4294967296#
End If
CopyByRefMemory lngSSubAuthority, lngRid, LenB(lngRid)
CopyByValMemory mByte(0), clssid, cbSidLength
Next Counter
'
' We need to copy the binary SID into a byte buffer so we can pass it to
' the LookupAccountSid API. This API is targeted to a particular server
' Copying the memory allows us to view the contents of the binary sid in the
' watch window of our VB application.
'
ReDim mByte(cbSidLength)
CopyByValMemory mByte(0), clssid, cbSidLength
'
' Use LookAccountSid to resolve the Domain\Username of the
' SID.
'
bRelValue = LookupAccountSid(Target, mByte(0), strUser, Len(strUser), strDomain, Len(strDomain), 1)
'
' Clean up the domain and userID strings. the return value of LookupAccountSid should be
' checked to be sure that the functions completed successfully
'
strUser = Left(strUser, InStr(strUser, Chr(0)) - 1)
strDomain = Left(strDomain, InStr(strDomain, Chr(0)) - 1)
ConvertSDDLtoSAM = Trim(strDomain) & "\" & Trim(strUser)
'
' Since we allocated memory for the binary SID, we must release it otherwise we
' cause a memory leak. The leak is not severe, but over time could add up.
'
LocalFree clssid
End Function
'
' GetSubAuthorityFromSDDL starts at startposition
' and returns the next "-" at the end as endposition.
' When the end of the descriptor is found, endposition = 0.
'
' If for some reason, a starting "-" is not found, then the function will
' return "" as the authority and endposition = 0.
'
Private Function GetSubAthorityFromSDDL(strSDDL As String, _
startposition As Integer, _
endposition As Integer) As String
Dim stInt As Integer
Dim strEnd As Integer
Dim subAuthStart As Long
Dim SubAuthEnd As Long
Dim Authority As String
' Find the base authority
'
subAuthStart = InStr(startposition, strSDDL, "-", vbTextCompare)
If (subAuthStart = 0) Then
'
' Could not locate the leading "-", set the error condition and return
'
endposition = 0
GetSubAthorityFromSDDL = ""
Else
'
' Found the leading "-", search for the ending "-"
'
SubAuthEnd = InStr(subAuthStart + 1, strSDDL, "-", vbTextCompare)
If (SubAuthEnd = 0) Then
'
' Did not not locate an ending "-", set
' the endposition value to 0 and return everything from the
' first "-" to the end of the string
'
Authority = Mid(strSDDL, subAuthStart + 1)
endposition = 0
GetSubAthorityFromSDDL = Authority
Else
'
' Found the ending "-", set endposition to its location
' and return all the characters from the first "-" to this location
'
Authority = Mid(strSDDL, (subAuthStart + 1), ((SubAuthEnd - 1) - subAuthStart))
endposition = SubAuthEnd
GetSubAthorityFromSDDL = Authority
End If
End If
End Function
Visual C++ code
// SDDLsid.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
#define MAX_SUB_AUTHORITIES 15
//
// Helper Function STUBS
//
// Function to locate sub authorities
//
UCHAR FindSubAuthorities( char* pSDDL, char *pAuths[] );
//
// Take the sub authorities array from FindSubAuthories and
// build a SID; return a pointer to it.
//
PSID BuildSidFromAuthorities( char *pAuths[], UCHAR lcAuths);
//
//
//-----------------------------------------------------------------
// Main console application executable.
//
int main(int argc, char* argv[])
{
char *lpszSDDL;
char *pStr, *pTarget;
char *pAuthorities[MAX_SUB_AUTHORITIES];
UCHAR nAuthorities = 0;
PSID pRawSID;
PSID pSysSID = NULL;
DWORD cbSysSID = 0;
//char szDomain[256];
//DWORD cbszDomain = 256;
SID_NAME_USE pSNU;
if( argc < 3 )
{
printf("Error, need a SDDL form of a SID\nExample: SDDLSid S-1-2-3-55569832-2398475 \\\\Target_Server\n");
return 0;
}
lpszSDDL = (char *)malloc(strlen(argv[1])+1);
pStr = argv[1];
pTarget = argv[2];
strcpy( lpszSDDL, (pStr+2));
//
// Find all of the sub authorities in the SDDL SID
// See comments on FindSubAuthorities for details
//
nAuthorities = FindSubAuthorities( lpszSDDL, pAuthorities );
long j = 0;
printf("Sub authority Count: %d\nSub Authority Values:\n", nAuthorities);
//
// Display the sub-Authority values
//
for ( j = 0; j <= nAuthorities; j++ )
printf("%s\n",pAuthorities[j]);
//
// Build a binary SID from the sub authorities
// See comments in BuildSidFromAuthorities for details
//
pRawSID = BuildSidFromAuthorities( pAuthorities, nAuthorities );
/*
Test code block used to verify that the code is functioning properlly. Took
a known SID, converted it to SDDL on Win2k, then used that SDDL sid in the code
for testing purposes.
if( !LookupAccountName("LOCAL_SERVER","FordP", pSysSID, &cbSysSID, szDomain, &cbszDomain, &pSNU) )
{
DWORD lstErr = GetLastError();
if( lstErr == 122 )
{
pSysSID = (PSID)LocalAlloc(LPTR, cbSysSID);
LookupAccountName("\\\\maxvdc1","FordP", pSysSID, &cbSysSID, szDomain, &cbszDomain, &pSNU);
if( EqualSid( pSysSID, pRawSID ))
printf("Sids are =\n");
else printf("SIDS are <> \n");
}
}
else printf("%d\n",GetLastError());
*/
if( pRawSID )
{
//
// Have a binary SID, lets retrieve the domain and user ID
//
char UserID[30];
char DomainID[256];
DWORD cbUserId = 30;
DWORD cbDomainId = 256;
BOOL bRet;
bRet= LookupAccountSid(
"\\\\maxvdc1", // name of local or remote computer
pRawSID, // security identifier
UserID, // account name buffer
&cbUserId, // size of account name buffer
DomainID, // domain name
&cbDomainId, // size of domain name buffer
&pSNU // SID type
);
if( bRet )
printf("SAM account form of %s \n is %s\\%s\n", argv[1], DomainID, UserID);
else
printf("Could not locate SID %d\n", GetLastError());
}
//
// Clean up all the memory allocated by the console application
//
if ( pRawSID ) LocalFree( (HLOCAL)pRawSID );
if ( lpszSDDL ) free ( lpszSDDL );
return 0;
}
//
// long FindSubAuthorities( char *pSDDL, char *pAuths[] );
//
// The return value is the number of sub authorities in the SID.
// Basically, the routine takes the SDDL form, searches for "-" characters
// and replaces them with NULLs and places a pointer to the start of
// the authority in the pAuths array so that each authority is separated by
// nulls.
//
// Example:
//
// SDDL SID-> S-1-5-21-853885456-2109860151-3743179773-1190
// would be converted to:
// S\01\05\021\0853885456\02109860151\03743179773\01190
// and the pAuths pointer array would be filled like:
// pAuths[0] -> pointer to '1'
// pAuths[1] -> pointer to '21'
// pAuths[2] -> pointer to '853885456'
// pAuths[3] -> pointer to '2109860151'
// pAuths[4] -> pointer to '3743179773'
// pAuths[5] -> pointer to '1190'
//
// The return value would be 5
//
// RETURN VALUES:
// Number of Sub Authorities found in the SDDL string
//
UCHAR FindSubAuthorities( char *pSDDL, char *pAuths[] )
{
char *strt;
BOOL bEnd = FALSE;
long lSubs = 0;
pAuths[lSubs] = pSDDL;
for( strt = pSDDL; *strt; strt++)
{
switch( *strt )
{
case '-':
bEnd = TRUE;
*strt = NULL;
lSubs++;
break;
default:
if( bEnd )
{
pAuths[lSubs] = strt;
bEnd = FALSE;
}
break;
}
}
return (UCHAR)(lSubs - 1);
}
//
// PSID BuildSidFromAuthorities( char *pAuths[]);
// This function takes an array that has been parsed by
// FindSubAuthorities function and converts it to a binary sid.
//
// RETURN VALUES:
// Returns NULL if the SID could not be created.
// Returns a PSID pointer if the SID was created successfully
//
PSID BuildSidFromAuthorities( char *pAuths[], UCHAR lcAuths)
{
//
// Allocate memory for the SID, this memory must be freed by the caller
//
PSID pLocalSid = (PSID)LocalAlloc(LPTR, GetSidLengthRequired(lcAuths));
BOOL bRet;
//
// The Authorities array contains pointer to the start of each sub authority.
// the pAuths[0] is pointing to the revisoin value, so we skip that one.
// Then pAuths[1] is pointer to the issuing authority for the SID. This value is going
// to be one of the values in the following case statement.
//
// Initialize the SID with the issuing authority and the number of sub authorities
//
switch( pAuths[1][0] )
{
case '0':
{
//
// SECURITY_NULL_SID_AUTHORITY
//
SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_NULL_SID_AUTHORITY;
bRet = InitializeSid( pLocalSid, &sAuth, lcAuths);
}
break;
case '1':
{
//
// SECURITY_WORLD_SID_AUTHORITY
//
SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_WORLD_SID_AUTHORITY;
bRet = InitializeSid( pLocalSid, &sAuth, lcAuths);
}
break;
case '2':
{
//
// SECURITY_LOCAL_SID_AUTHORITY
//
SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_LOCAL_SID_AUTHORITY;
bRet = InitializeSid( pLocalSid, &sAuth, lcAuths);
}
break;
case '3':
{
//
// SECURITY_CREATOR_SID_AUTHORITY
//
SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_CREATOR_SID_AUTHORITY;
bRet = InitializeSid( pLocalSid, &sAuth, lcAuths);
}
break;
case'5':
{
//
// SECURITY_NT_AUTHORITY
//
SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_NT_AUTHORITY;
bRet = InitializeSid( pLocalSid, &sAuth, lcAuths);
}
break;
default:
break;
}
if( bRet )
{
//
// SID created successfully!, add the sub authorities by
// walking the pointers in the pAuths array, converting them to
// DWORD and shoving back into the SID.
//
// The GetSidSubAuthority API returns a pointer to the location of
// a given sub authority. Once the string form of the subauthority is
// converted into a DWORD, it must be placed into the address pointed to by
// the return value of the GetSidSubAuthority API.
//
// All of these operations could be done in a single line of code, but have been
// seperated for clarity.
//
long j;
for( j = 2; j <= lcAuths+1; j++)
{
DWORD dwValue = (DWORD)atol(pAuths[j]);
PDWORD pdwSubAuth = GetSidSubAuthority( pLocalSid, (j-2));
*pdwSubAuth = dwValue;
}
}
else pLocalSid = NULL;
return pLocalSid;
}