public void TestDynamicGroupAccessExtensionNotAllowed(string groupou, string jitGroupName, string userName) { string groupname = Guid.NewGuid().ToString(); string fqGroupName = $"{jitGroupName.Split('\\')[0]}\\{groupname}"; IGroup jitGroup = directory.GetGroup(jitGroupName); jitGroup.RemoveMembers(); IUser user = directory.GetUser(userName); options.DynamicGroupMappings.Add(new JitDynamicGroupMapping() { Domain = jitGroup.Sid.AccountDomainSid.ToString(), GroupOU = groupou, GroupNameTemplate = groupname }); this.provider = new JitAccessProvider(directory, logger, this.GetOptions()); TimeSpan allowedAccess = provider.GrantJitAccessDynamicGroup(jitGroup, user, false, TimeSpan.FromMinutes(1), out _); Assert.AreEqual(1, allowedAccess.TotalMinutes); Thread.Sleep(TimeSpan.FromSeconds(20)); TimeSpan allowedAccess2 = provider.GrantJitAccessDynamicGroup(jitGroup, user, false, TimeSpan.FromMinutes(1), out _); Assert.LessOrEqual(allowedAccess2.TotalSeconds, 50); }
public void CreateDynamicGroup(string groupou, string jitGroupName, string userName) { string groupname = Guid.NewGuid().ToString(); string fqGroupName = $"{jitGroupName.Split('\\')[0]}\\{groupname}"; IGroup jitGroup = directory.GetGroup(jitGroupName); jitGroup.RemoveMembers(); IUser user = directory.GetUser(userName); options.DynamicGroupMappings.Add(new JitDynamicGroupMapping() { Domain = jitGroup.Sid.AccountDomainSid.ToString(), GroupOU = groupou, GroupNameTemplate = groupname }); this.provider = new JitAccessProvider(directory, logger, this.GetOptions()); provider.GrantJitAccessDynamicGroup(jitGroup, user, false, TimeSpan.FromMinutes(1), out _); Thread.Sleep(TimeSpan.FromSeconds(20)); IGroup ttlGroup = directory.GetGroup(fqGroupName); Assert.IsNotNull(ttlGroup); Assert.AreEqual(groupname, ttlGroup.SamAccountName); directory.IsSidInPrincipalToken(ttlGroup.Sid, jitGroup.Sid); directory.IsSidInPrincipalToken(user.Sid, ttlGroup.Sid); directory.IsSidInPrincipalToken(user.Sid, jitGroup.Sid); }
public void TestDynamicGroupAccessUndo(string groupou, string jitGroupName, string userName) { string groupname = Guid.NewGuid().ToString(); string fqGroupName = $"{jitGroupName.Split('\\')[0]}\\{groupname}"; IGroup jitGroup = directory.GetGroup(jitGroupName); jitGroup.RemoveMembers(); IUser user = directory.GetUser(userName); options.DynamicGroupMappings.Add(new JitDynamicGroupMapping() { Domain = jitGroup.Sid.AccountDomainSid.ToString(), GroupOU = groupou, GroupNameTemplate = groupname }); this.provider = new JitAccessProvider(directory, logger, this.GetOptions()); provider.GrantJitAccessDynamicGroup(jitGroup, user, true, TimeSpan.FromMinutes(1), out Action undo); Thread.Sleep(TimeSpan.FromSeconds(20)); Assert.IsNotNull(this.directory.GetGroup(fqGroupName)); undo(); Thread.Sleep(TimeSpan.FromSeconds(20)); Assert.IsFalse(this.directory.TryGetGroup(fqGroupName, out _)); }
public void ThrowOnNoMappingForDomain(string jitGroupName, string userName) { IGroup jitGroup = directory.GetGroup(jitGroupName); jitGroup.RemoveMembers(); IUser user = directory.GetUser(userName); this.provider = new JitAccessProvider(directory, logger, this.GetOptions()); Assert.Throws <NoDynamicGroupMappingForDomainException>(() => provider.GrantJitAccessDynamicGroup(jitGroup, user, false, TimeSpan.FromMinutes(1), out _)); }