Security Formats

The Security String Format is a more readable text format than the native Security Descriptor String Format and is the preferred format for AF Server versions 2.7 or later. This string format which is used to specify the access control rules has the following format:

userid1:ace_type1(rights1)|userid2:ace_type2(rights2)|... useridN:ace_typeN(rightsN)

For PI AF Server 2.7 and later which support the newer AFSecurityIdentity objects, the userid is the name of the AFSecurityIdentity for the access control rule. For older servers which only support the Security Descriptor String Format, the userid identifies the trustee of the ACE in NT Account form. If the account cannot be resolved, then the SID or common account abbreviation is used, as described in the SID Name Table in the Security Descriptor String Format Section.

The ace_type indicates the type of the access rule. This table lists the supported ACE type strings:

The rights string indicates the access rights controlled by the ACE. This string is a comma separated list of access right abbreviations as listed below or specify 'all' for all rights:

Here are a few examples of this format:

• Administrators:A(r,w,rd,wd,x,d,a)|World:A(r,rd)

• Operators:D(r,rd,wd)|Administrators:A(r,w,rd,wd,x,d,a)|Engineers:A(r,w,rd,wd)

• Operators:D(r,rd,wd)|Administrators:A(all)|Engineers:A(all)

• BUILTIN\Admin:A(r,w,rd,wd,x,d,a)|Everyone:A(r,rd)

The Security Descriptor String Format is a format defined by Microsoft (search for Security Descriptor String Format in MSDN for more information). For AF Server 2.7 and later, this format is obsoleted however is still available for backward compatibility. When used with an AF Server 2.7 and later, the windows users that are mapped to the security identities in the server's ACL will be auto-expanded into individual ACEs. Additionally, a manufactured SID will be included to represent the AF security identity. When used to write ACL's to the AF Server 2.7 or later, AF mappings and identities will be auto-created, when possible.

The format is a string with tokens to indicate each of the four main components of a security descriptor: owner(O:), primary group (G:), DACL (D:), and SACL (S:). AF does not use the SACL portion of the security descriptor. The string format most commonly used is specified in the following format:

O:owner_sid G:group_sid D:(string_ace1)(string_ace2)... (string_aceN) S:(string_ace1)(string_ace2)... (string_aceN)

The owner_sid and group_sid can use either the standard string representation of a SID (S-R-I-S-S...) or a well-known SID string constant. This table lists some of the most common well-known SID string constants:

A string_ace is a string that describes an ACE in the security descriptor's DACL or SACL (search for ACE Strings in MSDN for more information). Each ACE string is enclosed in parentheses. The commonly used fields of the ACE are in the following order and are separated by semicolons (fields that are not normally set are shown as empty):

ace_type;;rights;;;account_sid

The ace_type indicates the value of the AceType member of the ACE_HEADER structure. This table lists some of the most common ACE type strings:

The rights string indicates the access rights controlled by the ACE. This string can be a hexadecimal string representation of the access rights or it can be a concatenation of the access right strings. This table lists the ACE access rights string constants used by AF:

The account_sid identifies the trustee of the ACE in the same format as the owner_sid and group_sid described above.

Here are a few examples of this format:

• O:BAG:BAD:(A;;CC;;;WD)(A;;CCDCLCSWRP;;;BA)

• O:BAG:BAD:(A;;CCDCLCSWRPWPDTLOCR;;;BA)(A;;CCDCWP;;;WD)

• O:BAG:BAD:(D;;RP;;;S-1-5-21-2084324470-1890137325-1469997231-17242)(A;;CCDCLCSWRPWPDTLOCR;;;BA)(A;;CCWP;;;WD)

Reference