public JitDomainStatusViewModel(IDirectory directory, JitDynamicGroupMapping mapping, Domain domain, ILogger <JitDomainStatusViewModel> logger)
{
this.directory = directory;
this.Domain = domain;
this.forest = domain.Forest;
this.logger = logger;
this.Mapping = mapping;
this.DynamicGroupOU = mapping?.GroupOU;
_ = this.RefreshStatus();
}
private string BuildGroupSamAccountName(JitDynamicGroupMapping mapping, IUser user, IGroup group)
{
if (string.IsNullOrWhiteSpace(mapping.GroupNameTemplate))
{
return($"LITHNET-AMS-JIT-{group.SamAccountName}-{user.SamAccountName}");
}
else
{
return(mapping.GroupNameTemplate
.Replace("{user}", user.SamAccountName, StringComparison.OrdinalIgnoreCase)
.Replace("{group}", group.SamAccountName, StringComparison.OrdinalIgnoreCase));
}
}
public TimeSpan GrantJitAccessDynamicGroup(IGroup group, IUser user, bool canExtend, TimeSpan requestedExpiry, out Action undo)
{
JitDynamicGroupMapping mapping = this.FindDomainMapping(group);
string groupName = this.BuildGroupSamAccountName(mapping, user, group);
string description = this.BuildGroupDescription(mapping);
string fqGroupName = $"{this.BuildGroupDomain(group)}\\{groupName}";
TimeSpan grantedExpiry = requestedExpiry;
this.logger.LogTrace("Processing request to have {user} added to the JIT group {group} via dynamicObject {dynamicGroup}", user.MsDsPrincipalName, group.MsDsPrincipalName, fqGroupName);
if (directory.TryGetGroup(fqGroupName, out IGroup dynamicGroup))
{
this.logger.LogTrace("Dynamic group {dynamicGroup} already exists in the directory with a remaining ttl of {ttl}", dynamicGroup.MsDsPrincipalName, dynamicGroup.EntryTtl);
if (!canExtend)
{
this.logger.LogTrace("User {user} is not permitted to extend the access, so the ttl will remain unchanged", user.MsDsPrincipalName);
grantedExpiry = dynamicGroup.EntryTtl ?? new TimeSpan();
}
else
{
dynamicGroup.ExtendTtl(requestedExpiry);
this.logger.LogTrace("User {user} is permitted to extend the access, so the ttl will was updated to {ttl}", user.MsDsPrincipalName, requestedExpiry);
}
}
else
{
this.logger.LogTrace("Creating a new dynamic group {groupName} in {ou} with ttl of {ttl}", groupName, mapping.GroupOU, grantedExpiry);
dynamicGroup = this.directory.CreateTtlGroup(groupName, groupName, description, mapping.GroupOU, grantedExpiry);
this.logger.LogInformation(EventIDs.JitDynamicGroupCreated, "Created a new dynamic group {groupName} in {ou} with ttl of {ttl}", groupName, mapping.GroupOU, grantedExpiry);
}
this.logger.LogTrace("Adding user {user} to dynamic group {dynamicGroup}", user.MsDsPrincipalName, dynamicGroup.MsDsPrincipalName);
dynamicGroup.AddMember(user);
this.logger.LogTrace("Adding dynamic group {dynamicGroup} to the JIT group {jitGroup}", dynamicGroup.MsDsPrincipalName, group.MsDsPrincipalName);
group.AddMember(dynamicGroup);
undo = () =>
{
this.logger.LogTrace("Rolling back JIT access by deleting dynamic group {dynamicGroup} created for {user} to become a member of {group}", dynamicGroup.MsDsPrincipalName, user.MsDsPrincipalName, group.MsDsPrincipalName);
this.directory.DeleteGroup(fqGroupName);
this.logger.LogInformation(EventIDs.JitDynamicGroupDeleted, "Rolled back JIT access by deleting dynamic group {dynamicGroup} created for {user} to become a member of {group}", dynamicGroup.MsDsPrincipalName, user.MsDsPrincipalName, group.MsDsPrincipalName);
};
return(grantedExpiry);
}
public TimeSpan GrantJitAccessDynamicGroup(IGroup group, IUser user, string dcLocatorTarget, bool canExtend, TimeSpan requestedExpiry, out Action undo)
{
JitDynamicGroupMapping mapping = this.FindDomainMapping(group);
string groupName = this.BuildGroupSamAccountName(mapping, user, group);
string description = this.BuildGroupDescription(mapping);
string fqGroupName = $"{this.BuildGroupDomain(group)}\\{groupName}";
TimeSpan grantedExpiry = requestedExpiry;
this.logger.LogTrace("Processing request to have {user} added to the JIT group {group} via dynamicObject {dynamicGroup}", user.MsDsPrincipalName, group.Path, fqGroupName);
IGroup dynamicGroup = null;
this.discoveryServices.FindDcAndExecuteWithRetry(dcLocatorTarget, this.discoveryServices.GetDomainNameDns(mapping.GroupOU), DsGetDcNameFlags.DS_DIRECTORY_SERVICE_REQUIRED | DsGetDcNameFlags.DS_WRITABLE_REQUIRED, this.GetDcLocatorMode(), dc =>
{
this.logger.LogTrace("Attempting to perform dynamic group operation against DC {dc}", dc);
group.RetargetToDc(dc);
if (directory.TryGetGroup(fqGroupName, out dynamicGroup))
{
dynamicGroup.RetargetToDc(dc);
this.logger.LogTrace("Dynamic group {dynamicGroup} already exists in the directory with a remaining TTL of {ttl}", dynamicGroup.Path, dynamicGroup.EntryTtl);
if (!canExtend)
{
this.logger.LogTrace("User {user} is not permitted to extend the access, so the TTL will remain unchanged", user.MsDsPrincipalName);
grantedExpiry = dynamicGroup.EntryTtl ?? new TimeSpan();
}
else
{
dynamicGroup.ExtendTtl(requestedExpiry);
this.logger.LogTrace("User {user} is permitted to extend the access, so the TTL will was updated to {ttl}", user.MsDsPrincipalName, requestedExpiry);
}
}
else
{
this.logger.LogTrace("Creating a new dynamic group {groupName} in {ou} with TTL of {ttl}", groupName, mapping.GroupOU, grantedExpiry);
dynamicGroup = this.directory.CreateTtlGroup(groupName, groupName, description, mapping.GroupOU, dc, grantedExpiry, mapping.GroupType, true);
this.logger.LogInformation(EventIDs.JitDynamicGroupCreated, "Created a new dynamic group {group}", dynamicGroup.Path, grantedExpiry);
}
this.logger.LogTrace("Adding user {user} to dynamic group {dynamicGroup}", user.MsDsPrincipalName, dynamicGroup.Path);
dynamicGroup.AddMember(user);
this.logger.LogTrace("Adding dynamic group {dynamicGroup} to the JIT group {jitGroup}", dynamicGroup.Path, group.Path);
group.AddMember(dynamicGroup);
return(true);
});
undo = () =>
{
if (dynamicGroup != null)
{
this.logger.LogTrace("Rolling back JIT access by deleting dynamic group {dynamicGroup} created for {user} to become a member of {group}", dynamicGroup?.MsDsPrincipalName, user.MsDsPrincipalName, group.MsDsPrincipalName);
this.directory.DeleteGroup(fqGroupName);
this.logger.LogInformation(EventIDs.JitDynamicGroupDeleted, "Rolled back JIT access by deleting dynamic group {dynamicGroup} created for {user} to become a member of {group}", dynamicGroup?.MsDsPrincipalName, user.MsDsPrincipalName, group.MsDsPrincipalName);
}
};
return(grantedExpiry);
}
private string BuildGroupDescription(JitDynamicGroupMapping mapping)
{
return(mapping.Description ?? "Dynamic group created for a Lithnet Access Manager JIT request");
}
public JitDomainStatusViewModel CreateViewModel(Domain model, JitDynamicGroupMapping mapping)
{
return(new JitDomainStatusViewModel(directory, mapping, model, logger));
}
