Accessing/parsing "msDS-AllowedToActOnBehalfOfOtherIdentity" AD property in C#

Question

I have a need to manage Kerberos Resource Based Delegation in C# (I know it's easier in Powershell but that is not the requirement). The attribute on the user/computer/service accounts is msDS-AllowedToActOnBehalfOfOtherIdentity, but this seems to be some COM object which I can't seem to deal with in C#:

static void Main(string[] args)
{
    string ou = @"OU=some,OU=ou,DC=corp,DC=com";
    string cn = @"someaccount";

    DirectoryEntry de = new DirectoryEntry();

    de.Username = @"CORP\userwithOUrights";
    de.Password = @"password";
    de.AuthenticationType = AuthenticationTypes.Secure;
    de.Path = $"LDAP://CN={cn},{ou}";
    Object a = de.Properties["msDS-AllowedToActOnBehalfOfOtherIdentity"];
}

After this, a doesn't seem to be anything I can do much with, unlike other properties. It is some COM object and I need to get the accounts which are in there. Powershell reports that this property returns a System.DirectoryServices.ActiveDirectorySecurity object and I see useful methods in this class for decoding the binary format which is stored in AD etc. But this does not seem to be the return type from the property call in C#.

Answer 1

Update: All of this is now better documented in an article on my website: Handling NT Security Descriptor attributes

---

According to this the "attribute syntax" for that attribute is 2.5.5.15. According to this, that means it's a "String(NT-Sec-Desc)". According to this, that means it's a IADsSecurityDescriptor COM object.

You can add a COM reference in your project to "Active DS Type library" and cast it directly to IADsSecurityDescriptor, like this:

var act = (ActiveDs.IADsSecurityDescriptor)
              de.Properties["msDS-AllowedToActOnBehalfOfOtherIdentity"].Value;
Console.WriteLine(act.Owner);

The Owner property gives you a DOMAIN\Username.

According to this random code I found, it seems you can also use the RawSecurityDescriptor class to interact with it. There is a constructor that takes a plain string, but you also can't seem to get the raw string from the attribute from DirectoryEntry.

But I did remember that sometimes DirectorySearcher will give you values in a different type than DirectoryEntry (doesn't make sense, but it's true). That appears to be true here. DirectorySearcher gives this attribute to you as a byte[], and RawSecurityDescriptor does have a constructor that takes a byte[].

So it seems you can do something like this:

string ou = @"OU=some,OU=ou,DC=corp,DC=com";
string cn = @"someaccount";

var search = new DirectorySearcher(new DirectoryEntry($"LDAP://{ou}"), $"(cn={cn})");
search.PropertiesToLoad.Add("msDS-AllowedToActOnBehalfOfOtherIdentity");

var result = search.FindOne();

var act = new RawSecurityDescriptor(
    (byte[]) result.Properties["msDS-AllowedToActOnBehalfOfOtherIdentity"][0], 0);

Console.WriteLine(act.Owner);

//make changes to act.DiscretionaryAcl

byte[] descriptor_buffer = new byte[act.BinaryLength];
act.GetBinaryForm(descriptor_buffer, 0);

var de = result.GetDirectoryEntry();
de.Properties["msDS-AllowedToActOnBehalfOfOtherIdentity"].Value = descriptor_buffer;
de.CommitChanges();

In this, act.Owner is an account SID.