Skip to content

Include Membership property set in AddSelf and AddMember edges #266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JimSycurity merged 3 commits into from
Dec 19, 2025
Merged

Include Membership property set in AddSelf and AddMember edges #266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5215485
feat: add membership property set BED-7069
JimSycurity Dec 18, 2025
f205a92
fix logic BED-7069
JimSycurity Dec 18, 2025
c31b3b9
chore: better name for property set BED-7069
JimSycurity Dec 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/CommonLib/Processors/ACEGuids.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ public class ACEGuids
public const string UserForceChangePassword = "00299570-246d-11d0-a768-00aa006e0529";
public const string AllGuid = "00000000-0000-0000-0000-000000000000";
public const string WriteMember = "bf9679c0-0de6-11d0-a285-00aa003049e2";
public const string MembershipPropertySet = "bc0ac240-79a9-11d0-9020-00c04fc2d4cf"; // property set https://learn.microsoft.com/en-us/windows/win32/adschema/r-membership
public const string WriteAllowedToAct = "3f78c3e5-f79a-46bd-a0b8-9d18116ddc79";
public const string WriteSPN = "f3a64788-5306-11d1-a9c5-0000f80367c1";
public const string AddKeyPrincipal = "5b47d60f-6090-40b2-9f37-2a4de88f3063";
Expand Down
4 changes: 2 additions & 2 deletions src/CommonLib/Processors/ACLProcessor.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -584,7 +584,7 @@ public async IAsyncEnumerable<ACE> ProcessACL(byte[] ntSecurityDescriptor, strin
if (aceRights.HasFlag(ActiveDirectoryRights.Self) &&
!aceRights.HasFlag(ActiveDirectoryRights.WriteProperty) &&
!aceRights.HasFlag(ActiveDirectoryRights.GenericWrite) && objectType == Label.Group &&
aceType is ACEGuids.WriteMember or ACEGuids.AllGuid)
aceType is ACEGuids.WriteMember or ACEGuids.MembershipPropertySet or ACEGuids.AllGuid)
yield return new ACE {
PrincipalType = resolvedPrincipal.ObjectType,
PrincipalSID = resolvedPrincipal.ObjectIdentifier,
Expand Down Expand Up @@ -786,7 +786,7 @@ or Label.NTAuthStore
IsPermissionForOwnerRightsSid = isPermissionForOwnerRightsSid,
IsInheritedPermissionForOwnerRightsSid = isInheritedPermissionForOwnerRightsSid,
};
else if (objectType == Label.Group && aceType == ACEGuids.WriteMember)
else if (objectType == Label.Group && (aceType is ACEGuids.WriteMember or ACEGuids.MembershipPropertySet))
yield return new ACE {
PrincipalType = resolvedPrincipal.ObjectType,
PrincipalSID = resolvedPrincipal.ObjectIdentifier,
Expand Down
Loading