Andrew,
Thank you for the feedback. I have passed on your suggestion to the AD product
group and the concerned people will review it.
FYI, I noticed your LDF did not include the following. Just passing along. This
is not to guarantee or to give any hint in one way or another of anything about
a review outcome.
dn: CN=DS-Validated-Write-Computer,CN=Extended-Rights,${CONFIGDN}
changetype: ntdsSchemaAdd
objectClass: controlAccessRight
displayName: Validated write to computer attributes.
rightsGuid: 9b026da6-0d3c-465c-8bee-5199d7165cba
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
ShowInAdvancedViewOnly: TRUE
validAccesses: 8
Thanks,
Edgar
-----Original Message-----
From: Andrew Bartlett [mailto:abart...@samba.org]
Sent: Sunday, December 10, 2017 10:14 PM
To: Garming Sam <garm...@catalyst.net.nz>; Edgar Olougouna
<edg...@microsoft.com>
Cc: cifs-protocol@lists.samba.org; MSSolve Case Email
<casem...@corp.microsoft.com>
Subject: Re: [cifs-protocol] Extended rights as LDIF, 117112017192160
On Fri, 2017-12-08 at 15:10 +1300, Garming Sam wrote:
> Hi Edgar,
>
> I've been looking at the usage of validAccesses a bit further and I
> found some statements in MS-ADTS which mention its protocol relevance.
> In particular I notice that there is a statement mentioning what
> values it must have in the case for control access rights.
>
> [MS-ADTS] 5.1.3.2.1 Control Access Rights
>
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsdn.
> microsoft.com%2Fen-us%2Flibrary%2Fcc223512.aspx&data=04%7C01%7Cedgaro%
> 40microsoft.com%7C0c9ed40a3c0044ff674908d5404dad01%7C72f988bf86f141af9
> 1ab2d7cd011db47%7C1%7C0%7C636485624717963137%7CUnknown%7CTWFpbGZsb3d8e
> yJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata
> =s4rYHpQ1rNbyFq0%2FAoHiWKb4JJF3i%2Bz4TF1ElIJ7KEU%3D&reserved=0
>
> "validAccesses: The type of access right bits in the ACCESS_MASK field
> of an ACE with which the control access right can be associated. The
> only permitted access right for control access rights is
> RIGHT_DS_CONTROL_ACCESS (CR)."
>
> It appears that section 5.1.3 contains some of the information we were
> seeking in regards to this attribute (and how the set of rights are
> divided into the different classes). There also appears to be another
> section on property sets which mentions which are under this category.
> However the corresponding validAccesses value required for these
> rights appears to only be mentioned in a non-normative document:
>
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsdn.
> microsoft.com%2Fen-us%2Flibrary%2Fms675747(v%3Dvs.85).aspx&data=04%7C0
> 1%7Cedgaro%40microsoft.com%7C0c9ed40a3c0044ff674908d5404dad01%7C72f988
> bf86f141af91ab2d7cd011db47%7C1%7C0%7C636485624717963137%7CUnknown%7CTW
> FpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D
> %7C-1&sdata=h4VcKRjUe0t%2BpnK%2BvSLkt8jYMDBDNjilZZ3rlVHgERA%3D&reserve
> d=0
>
> Given the disparate set of information, it would be useful to have
> validAccesses documented for each extended-right collected with the
> other attributes given in 6.1.1.2.7 Extended Rights, and the reference
> in 6.1.1.2.7.1 controlAccessRight objects removed which asserts that
> the information is implementation specific. While a full set of
> published ldif would be most helpful, getting the existing information
> collated would be a definite improvement.
>
G'Day Edgar,
Given the various bits of info above and in the public
WindowsServerDocs github repo, we have constructed the attached. It
isn't perfect, but it shows that this is actually essentially covered in the
docs.
You mentioned on or last call that you are happy to take suggestions for
improving the docs, and this is certainly an area we would like improved. That
is, we would like to have something like this file provided, just as the
Display Specifiers and Schema have been provided, as LDIF.
(As I'm sure you know for full interoperability our standard is that we need to
be able to have the full set of matching objects.)
Otherwise, would it be possible to add a reference, informative or normative to
resources like:
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftechnet.microsoft.com%2Flibrary%2Fdd378876.aspx&data=04%7C01%7Cedgaro%40microsoft.com%7C0c9ed40a3c0044ff674908d5404dad01%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636485624717963137%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata=FVxPJBZbWZMjaFlpvl6nQS3afZA8aSRbruCOiDA33BI%3D&reserved=0
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fcc730930(v%3Dws.10).aspx&data=04%7C01%7Cedgaro%40microsoft.com%7C0c9ed40a3c0044ff674908d5404dad01%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636485624717963137%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata=C2Fc408N1f8LGwU%2FRJ%2BJ2ZhewlC9%2BmoAKX29F8c7%2F84%3D&reserved=0
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdd378828(v%3Dws.10).aspx&data=04%7C01%7Cedgaro%40microsoft.com%7C0c9ed40a3c0044ff674908d5404dad01%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636485624717963137%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata=ArBJGLvEkPdR2BgLXkxI3NlJeB%2BUTgM7CwhMmMMdFto%3D&reserved=0
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fms683985(v%3Dvs.85).aspx&data=04%7C01%7Cedgaro%40microsoft.com%7C0c9ed40a3c0044ff674908d5404dad01%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636485624717963137%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata=eh0kFuctCjR8a10gYg%2FoY7vZh6FXsXMMpmxvFKT4QfU%3D&reserved=0
That would allow this existing content to be captured under the license for our
use, which would be very helpful.
Thanks!
Andrew Bartlett
--
Andrew Bartlett
https://na01.safelinks.protection.outlook.com/?url=https:%2F%2Fsamba.org%2F~abartlet%2F&data=04%7C01%7Cedgaro%40microsoft.com%7C0c9ed40a3c0044ff674908d5404dad01%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636485624717963137%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata=LZu3Y58vHJMFywyHiqZU8T3LuehLCajGzx8zI2nJkPw%3D&reserved=0
Authentication Developer, Samba Team
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsamba.org&data=04%7C01%7Cedgaro%40microsoft.com%7C0c9ed40a3c0044ff674908d5404dad01%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636485624717963137%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata=ElpX3eBcUUKVJitYZgTzuCz3%2BY5Mo4s8AHW%2BCP%2FzHDU%3D&reserved=0
Samba Development and Support, Catalyst IT
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcatalyst.net.nz%2Fservices%2Fsamba&data=04%7C01%7Cedgaro%40microsoft.com%7C0c9ed40a3c0044ff674908d5404dad01%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636485624717963137%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-1&sdata=B3noqVwgTgaEtBICSckDjfjDRku54hPnsf9THXOH5dQ%3D&reserved=0
_______________________________________________
cifs-protocol mailing list
cifs-protocol@lists.samba.org
https://lists.samba.org/mailman/listinfo/cifs-protocol
