Check Authorization on ActiveDirectory Object

I want to test if an arbit开发者_开发问答rary user has write-access to attributes of a particular Active Directory object. I think one part of the solution appears to be this:

NTAccount Account = new NTAccount("Domain\\XYZ");
SecurityIdentifier Sid =
(SecurityIdentifier)Account.Translate(typeof(SecurityIdentifier));

That seems to allow me to get a concrete representation from a string representation of the user. Another piece of the puzzle I think is this:

string strMemberString = "LDAP://OU=Test,DC=Domain,DC=local";
DirectoryEntry computers = new DirectoryEntry();
computers.Path = strMemberString;
computers.Options.SecurityMasks = SecurityMasks.Owner | SecurityMasks.Group
| SecurityMasks.Dacl | SecurityMasks.Sacl;

foreach (DirectoryEntry computer in computers.Children)
{
   if (computer.Name == "CN=Test")
   {
      ActiveDirectorySecurity sdc = computer.ObjectSecurity;
      //...

Not sure where to go from there. How do I finish this? Is there an entirely different way I should be pursuing? I'm using .net 4.0.

I'd prefer that the solution be entirely BCL code, rather than PInvoke or WMI.

I think that the best way is to look for a class that gives the "Effective Rights" as represented in a tab of the advanced dialog box in the security tab of an AD object :

It exists also a command line tool called ACLDiag.exe that do what you want.

(Edited) To find groups a user belongs to you can

• Write a recursive query program, It gives bad performance in big organizations.

• Use of a special matching rule called "LDAP_MATCHING_RULE_IN_CHAIN" (See Search Filter Syntax for more information). I give an example in this other question. It's a bit long too, but as far as I know, it's the only way to retreive security AND distribution groups.

• use the 'tokenGroups' attribute. It'is a computed attribute which holds the ids of every SecurityGroup the user is a member of, including the indirect groups. I think this the one you can use and that is provided with the UserPrincipal.GetAuthorizationGroups method (in the System.DirectoryServices.AccountManagement namespace and introduced in .Net 3.5)

You need to inspect the allowedAttributesEffective attribute.