HOWTO - 设定授权的Active Directory权限

Question

我已经创建了一个C＃web服务，使我们的前端支持团队使用的System.DirectoryServices

，我想更新

场查看和更新​​一些选定的Active Directory值[工作]职位，部门，电话和雇员。

我可以使用服务帐户“代表权”更新[任务]职务，部门，电话等，但是当我尝试更新雇员，我得到一个“未授权”的错误消息。

如果我使用域管理员帐户，则相同的代码工作正常。

我不想使用域管理员帐户此WebService，有什么特权，我需要？

Answer 1

ANSWER

的ADS_SCHEMA_ID_GUID_USER GUID可以更新基本用户类的细节，包括雇员ID

Based on MSDN article

用于授予服务帐户的用户所选择的委派权限VBScript的：

REM # 
REM # Delegate AD property set admin rights to named account 
REM # Based on: http://www.microsoft.com/technet/scriptcenter/topics/security/propset.mspx 
REM # 

Const TRUSTEE_ACCOUNT_SAM   = "ad\ADStaffUpdates" 

Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT  = &H5 
Const ADS_RIGHT_DS_READ_PROP   = &H10 
Const ADS_RIGHT_DS_WRITE_PROP   = &H20 
Const ADS_FLAG_OBJECT_TYPE_PRESENT  = &H1 
Const ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT = &H2 
Const ADS_ACEFLAG_INHERIT_ACE   = &H2 

Const ADS_SCHEMA_ID_GUID_USER   = "{bf967aba-0de6-11d0-a285-00aa003049e2}" 
Const ADS_SCHEMA_ID_GUID_PS_PERSONAL  = "{77b5b886-944a-11d1-aebd-0000f80367c1}" 
Const ADS_SCHEMA_ID_GUID_PS_PUBLIC  = "{e48d0154-bcf8-11d1-8702-00c04fb96050}" 

ad_setUserDelegation "OU=USERS, DC=AD, DC=COM", TRUSTEE_ACCOUNT_SAM, ADS_SCHEMA_ID_GUID_PS_USER 
ad_setUserDelegation "OU=USERS, DC=AD, DC=COM", TRUSTEE_ACCOUNT_SAM, ADS_SCHEMA_ID_GUID_PS_PERSONAL 
ad_setUserDelegation "OU=USERS, DC=AD, DC=COM", TRUSTEE_ACCOUNT_SAM, ADS_SCHEMA_ID_GUID_PS_PUBLIC 

Function ad_setUserDelegation(   _ 
     ByVal strOU   _ 
     ,ByVal strTrusteeAccount _ 
     ,ByVal strSchema_GUID  _ 
     ) 

    Set objSdUtil   = GetObject("LDAP://" & strOU) 

    Set objSD   = objSdUtil.Get("ntSecurityDescriptor") 
    Set objDACL    = objSD.DiscretionaryACL 

    Set objAce   = CreateObject("AccessControlEntry") 

    objAce.Trustee   = strTrusteeAccount 
    objAce.AceFlags   = ADS_ACEFLAG_INHERIT_ACE 
    objAce.AceType   = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT 
    objAce.Flags   = ADS_FLAG_OBJECT_TYPE_PRESENT OR ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT 

    objAce.ObjectType  = strSchema_GUID 

    objACE.InheritedObjectType = ADS_SCHEMA_ID_GUID_USER 
    objAce.AccessMask  = ADS_RIGHT_DS_READ_PROP OR ADS_RIGHT_DS_WRITE_PROP 
    objDacl.AddAce   objAce 

    objSD.DiscretionaryAcl  = objDacl 

    objSDUtil.Put   "ntSecurityDescriptor", Array(objSD) 
    objSDUtil.SetInfo 

End Function 


Function ad_revokeUserDelegation(  _ 
     ByVal strOU   _ 
     ,ByVal strTrusteeAccount _ 
     ) 

    Set objSdUtil   = GetObject("LDAP://" & strOU) 

    Set objSD   = objSdUtil.Get("ntSecurityDescriptor") 
    Set objDACL    = objSD.DiscretionaryACL 

    For Each objACE in objDACL 
     If UCase(objACE.Trustee) = UCase(strTrusteeAccount) Then 
       objDACL.RemoveAce objACE 
     End If 
    Next 

    objSDUtil.Put   "ntSecurityDescriptor", Array(objSD) 
    objSDUtil.SetInfo 

End Function 

Answer 2

的代码示例（移动至少部分）

string distinguishedname = "CN=Wicks\, Guy,OU=Users,DC=ad,DC=com" 
using (DirectoryEntry myDirectoryEntry = new DirectoryEntry(string.Format("LDAP://{0}", distinguishedname), null, null, AuthenticationTypes.Secure)) 
{ 
    try 
    { 
     myDirectoryEntry.Username = "serviceaccount"; 
     myDirectoryEntry.Password = "pa55word"; 

     myDirectoryEntry.Properties["employeeid"][0] = employeeID; 
     myDirectoryEntry.CommitChanges(); 
     setresult.result  = myDirectoryEntry.Properties["employeeid"][0].ToString(); 
    } 
    catch (Exception ex) 
    { 
     setresult.result  = ex.Message; 
    } 
} // end using 

（我做我的C＃道歉）

Answer 3

做你的服务的用户必须修改通过AD用户和计算机这些领域的权利？ 如果他们是那么也许你可以使用模拟，只是让你的服务主机“信任代表团”（在AD属性为它）总是为我工作得很好。