Meik/LIAM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Safeguard NTFS AD group reuse

Browse Source
This commit is contained in:
Meik
2026-07-16 15:43:00 +02:00
parent c4efc41c4b
commit c1e26ba615
4 changed files with 266 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
LiamNtfs/C4IT.LIAM.Ntfs.cs
View File

@@ -144,6 +144,8 @@ namespace C4IT.LIAM
private const string AdditionalConfigurationGroupNameSanitizeReplacementKey = "NtfsGroupNameSanitizeReplacement";
private const string AdditionalConfigurationPreserveAdGroupNameCaseKey = "PreserveNtfsAdGroupNameCase";
private const string AdditionalConfigurationAdDomainControllersKey = "NtfsAdDomainControllers";
private const string AdditionalConfigurationAdGroupReuseModeKey = "NtfsAdGroupReuseMode";
private const string AdditionalConfigurationAdGroupMarkerBackfillKey = "NtfsAdGroupMarkerBackfill";
public readonly cNtfsBase ntfsBase = new cNtfsBase();
public readonly cActiveDirectoryBase activeDirectoryBase = new cActiveDirectoryBase();
private readonly Dictionary<string, HashSet<string>> publishedShareCache = new Dictionary<string, HashSet<string>>(StringComparer.OrdinalIgnoreCase);
@@ -1394,6 +1396,8 @@ namespace C4IT.LIAM
engine.CanManagePermissionsForPath = IsPermissionManagedFolderPath;
engine.CanManageTraversePermissionsForPath = IsTraversePermissionManagedPath;
engine.forceStrictAdGroupNames = IsAdditionalConfigurationEnabled("ForceStrictAdGroupNames");
engine.adGroupReuseMode = GetAdGroupReuseMode();
engine.adGroupMarkerBackfill = IsAdditionalConfigurationEnabled(AdditionalConfigurationAdGroupMarkerBackfillKey);
engine.groupNameSanitizeReplacement = GetAdditionalConfigurationValueOrDefault(
AdditionalConfigurationGroupNameSanitizeReplacementKey,
Helper.DefaultGroupNameSanitizeReplacement);
@@ -1458,6 +1462,25 @@ namespace C4IT.LIAM
return rawValue == null ? string.Empty : rawValue.Trim();
}
private SecurityGroupReuseMode GetAdGroupReuseMode()
{
var value = GetAdditionalConfigurationValue(AdditionalConfigurationAdGroupReuseModeKey);
if (string.IsNullOrWhiteSpace(value))
return SecurityGroupReuseMode.Safe;
if (value.Equals("Safe", StringComparison.OrdinalIgnoreCase))
return SecurityGroupReuseMode.Safe;
if (value.Equals("Name", StringComparison.OrdinalIgnoreCase))
{
LogEntry("NtfsAdGroupReuseMode=Name is active. Existing AD groups may be reused by name without ACL/marker validation.", LogLevels.Warning);
return SecurityGroupReuseMode.Name;
}
LogEntry($"AdditionalConfiguration '{AdditionalConfigurationAdGroupReuseModeKey}' has invalid value '{value}'. Defaulting to Safe.", LogLevels.Warning);
return SecurityGroupReuseMode.Safe;
}
private string GetEffectiveTraverseBoundaryPath()
{
var configuredBoundaryPath = GetAdditionalConfigurationValue(AdditionalConfigurationTraverseBoundaryPathKey);