Hi, In the course of my work in implementing security descriptor inheritance in Directory service of Samba 4, I came across the following statement in MS-DTYP, 2.5.2 "The token also contains an ACL, Token.DefaultDACL, that serves as the DACL assigned by default to any objects created by the user. "
So, am I right to understand that this DACL is used when no nTSecurityDescriptor is provided by the incoming LDAP add request, and there is no defaultSecurityDescriptor for the objectClass. If so, how is the Token.DefaultDACL constructed and when? Is this based on the user's credentials and how? In addition, I have a question about the security descriptor creation algorithm described in MS-DTYP 2.5.2.3 One of the arguments of CreateSecurityDescriptor is: CreatorDescriptor: Security descriptor for the new object provided by the creator of the object. Caller can pass NULL. Am I right in understanding that this is either the nTSecurityDescriptor attribute provided by the user, or, in the lack thereof, the defaultSecurityDescriptor of the object class? Best Regards, Nadezhda Ivanova _______________________________________________ cifs-protocol mailing list cifs-protocol@cifs.org https://lists.samba.org/mailman/listinfo/cifs-protocol
