How do I create a custom Active Directory permission and group so that I can verify users against this?

Question

I have looked at many search results but I am struggling to find a way to programmatically (using C#) create a custom permission and a custom group in Active Directory.

I have an application that will need to have about 50 individual permissions, such as: can encrypt data, can decrypt data, can export private key, can delete keypair, etc. These permissions will be assigned to a custom group. For instance, the group may be called: standard user, security manager, etc.

Users will be assigned one or more of these groups. I need all of this to be managed through Active Directory. The software that is being written is in C#. The users will be in Active Directory.

The software will check that the user has a particular permission when a function on the application is to be executed. If the user does not have permission then they will be required to enter an override. This override is simply a prompt for the credentials of another user who DOES have the relevant permissions.

I want to emphasise that this needs to be managed through Active Directory because the software is running on a domain and the permissions will be managed by the Domain Administrator.

As such, I believe the ASP.Net Roles functionality is not sufficient? In addition, I am not sure if Azure AD is the same as Windows AD.

I would very much appreciate any guidance as to which .NET assembly/namespace will provide the following capability:

• Create permission
• Create group
• Assign permission to group
• Assign user to group
• Remove user from group
• Remove permission from group

I need to to do this programatically because the software will have an installer and will be responsible for adding the application-specific custom permissions and groups during installation if they do not already exist.

It may be possible that I am approaching this wrong so I am open to suggestions otherwise. As long as I am able to perform the above then great!

Thank you!

Answer 1

As I understood,

Here you can try below code

Try once

1) Create Group

                PrincipalContext principalContext =
                    new PrincipalContext(ContextType.Domain, LDAPDomain, LDAPContainer,
                        LDAPAdmin, LDAPPassword);

                GroupPrincipal group = GroupPrincipal.FindByIdentity(principalContext, "groupName");

                if (group == null)
                {
                    GroupPrincipal groupPrincipal = new GroupPrincipal(principalContext);
                    groupPrincipal.Name = "groupName";
                    groupPrincipal.SamAccountName = "samAccountName";
                    groupPrincipal.UserPrincipalName = "userPrincipleName";
                    groupPrincipal.GroupScope = GroupScope.Global;
                    groupPrincipal.Description = "groupNameDescription";
                    groupPrincipal.DisplayName = "groupNameDisplayName";
                    groupPrincipal.Save();
                }

2) Add User To Group

            GroupPrincipal group = GroupPrincipal.FindByIdentity(principalContext, "groupName");
            UserPrincipal user = UserPrincipal.FindByIdentity(principalContext, "userName");

            bool isUserAdded = false;


            if (user != null & group != null)
            {
                if (user.IsMemberOf(group))
                {
                    //Do Code
                }
                else
                {
                    group.Members.Add(user);
                    group.Save();
                    isUserAdded = user.IsMemberOf(group);
                }
            }

            if (isUserAdded)
            {
                //Do Code
            }

3) Remove User From Group

                GroupPrincipal group = GroupPrincipal.FindByIdentity(principalContext, "groupName");
                UserPrincipal user = UserPrincipal.FindByIdentity(principalContext, "userName");

                bool isUserRemoved = false;


                if (user != null & group != null)
                {
                    if (user.IsMemberOf(group))
                    {
                        group.Members.Remove(user);
                        group.Save();
                        isUserRemoved = user.IsMemberOf(group);
                    }
                    else
                    {
                        //Do Code

                    }
                }

                if (!isUserRemoved)
                {
                    //Do Code
                }

4) Add or Remove AccessRule(Permission) to Group

From my side, I have no clear idea about what actually your logic or implementation,

But Here I tried to give a solution for adding or remving access rule to group

            //DirectoryEntry for OU Level
            DirectoryEntry directoryEntry = new DirectoryEntry("LDAP://OU=MYOU,DC=MYDC,DC=COM");

            NTAccount account = new NTAccount("MYDC", "groupName");

            ActiveDirectoryAccessRule ruleRead = new ActiveDirectoryAccessRule(
                account,
                ActiveDirectoryRights.ReadProperty,
                AccessControlType.Allow,
                ActiveDirectorySecurityInheritance.None);

            ActiveDirectoryAccessRule ruleWrite = new ActiveDirectoryAccessRule(
                account,
                ActiveDirectoryRights.WriteProperty,
                AccessControlType.Deny,
                ActiveDirectorySecurityInheritance.None);

            if (Permission == "User shall be able to export private key from an RSA keypair")
            {
                directoryEntry.ObjectSecurity.AddAccessRule(ruleRead);

                directoryEntry.ObjectSecurity.AddAccessRule(ruleWrite);

                directoryEntry.Options.SecurityMasks = SecurityMasks.Dacl;

                directoryEntry.CommitChanges();

                Console.WriteLine("Added Deny Access to Read & Write.");
            }

            if (Permission == "User is able to decrypt imported data")
            {
                directoryEntry.ObjectSecurity.RemoveAccessRule(ruleRead);

                directoryEntry.ObjectSecurity.RemoveAccessRule(ruleWrite);

                directoryEntry.Options.SecurityMasks = SecurityMasks.Dacl;

                directoryEntry.CommitChanges();

                Console.WriteLine("Removed Deny Access to Read & Write.");
            }

            directoryEntry.Close();

            directoryEntry.Dispose();

Note: Please test all above code in your test environment first.

Answer 2

You're trying to use AD as both your AuthZ store and your AuthZ engine if I follow the question correctly. The former (using it as a data store) makes perfect sense, but, I don't think it's the right tool to evaluate access for your app.

What I would do is layer your groups in two levels:

• Level 1 - permission groups (e.g. can encrypt, can decrypt, etc.)

• Level 2 - roles - these are members of various permission groups, and in turn users are added to these groups to grant them the roles. They will inherit the permissions the roles have when their logon token is built by Windows.

Assuming your app uses Windows Authentication, the WindowsTokenRoleProvider (https://msdn.microsoft.com/en-us/library/system.web.security.windowstokenroleprovider(v=vs.110).aspx) will surface all of the group memberships up into your app and you can then check if someone is in a permission group and let them do something (or not)...