Ejemplo n.º 1
0
        public TimeSpan GrantJitAccessDynamicGroup(IGroup group, IUser user, string dcLocatorTarget, bool canExtend, TimeSpan requestedExpiry, out Action undo)
        {
            JitDynamicGroupMapping mapping = this.FindDomainMapping(group);
            string groupName   = this.BuildGroupSamAccountName(mapping, user, group);
            string description = this.BuildGroupDescription(mapping);
            string fqGroupName = $"{this.BuildGroupDomain(group)}\\{groupName}";

            TimeSpan grantedExpiry = requestedExpiry;

            this.logger.LogTrace("Processing request to have {user} added to the JIT group {group} via dynamicObject {dynamicGroup}", user.MsDsPrincipalName, group.Path, fqGroupName);

            IGroup dynamicGroup = null;

            this.discoveryServices.FindDcAndExecuteWithRetry(dcLocatorTarget, this.discoveryServices.GetDomainNameDns(mapping.GroupOU), DsGetDcNameFlags.DS_DIRECTORY_SERVICE_REQUIRED | DsGetDcNameFlags.DS_WRITABLE_REQUIRED, this.GetDcLocatorMode(), dc =>
            {
                this.logger.LogTrace("Attempting to perform dynamic group operation against DC {dc}", dc);

                group.RetargetToDc(dc);

                if (directory.TryGetGroup(fqGroupName, out dynamicGroup))
                {
                    dynamicGroup.RetargetToDc(dc);

                    this.logger.LogTrace("Dynamic group {dynamicGroup} already exists in the directory with a remaining TTL of {ttl}", dynamicGroup.Path, dynamicGroup.EntryTtl);

                    if (!canExtend)
                    {
                        this.logger.LogTrace("User {user} is not permitted to extend the access, so the TTL will remain unchanged", user.MsDsPrincipalName);
                        grantedExpiry = dynamicGroup.EntryTtl ?? new TimeSpan();
                    }
                    else
                    {
                        dynamicGroup.ExtendTtl(requestedExpiry);
                        this.logger.LogTrace("User {user} is permitted to extend the access, so the TTL will was updated to {ttl}", user.MsDsPrincipalName, requestedExpiry);
                    }
                }
                else
                {
                    this.logger.LogTrace("Creating a new dynamic group {groupName} in {ou} with TTL of {ttl}", groupName, mapping.GroupOU, grantedExpiry);
                    dynamicGroup = this.directory.CreateTtlGroup(groupName, groupName, description, mapping.GroupOU, dc, grantedExpiry, mapping.GroupType, true);
                    this.logger.LogInformation(EventIDs.JitDynamicGroupCreated, "Created a new dynamic group {group}", dynamicGroup.Path, grantedExpiry);
                }

                this.logger.LogTrace("Adding user {user} to dynamic group {dynamicGroup}", user.MsDsPrincipalName, dynamicGroup.Path);
                dynamicGroup.AddMember(user);

                this.logger.LogTrace("Adding dynamic group {dynamicGroup} to the JIT group {jitGroup}", dynamicGroup.Path, group.Path);
                group.AddMember(dynamicGroup);

                return(true);
            });

            undo = () =>
            {
                if (dynamicGroup != null)
                {
                    this.logger.LogTrace("Rolling back JIT access by deleting dynamic group {dynamicGroup} created for {user} to become a member of {group}", dynamicGroup?.MsDsPrincipalName, user.MsDsPrincipalName, group.MsDsPrincipalName);
                    this.directory.DeleteGroup(fqGroupName);
                    this.logger.LogInformation(EventIDs.JitDynamicGroupDeleted, "Rolled back JIT access by deleting dynamic group {dynamicGroup} created for {user} to become a member of {group}", dynamicGroup?.MsDsPrincipalName, user.MsDsPrincipalName, group.MsDsPrincipalName);
                }
            };

            return(grantedExpiry);
        }