Does .IsInRole work for SIDS in the sidhistory attribute?

userzNTJ 0
Viewed 17

We are migrating to another network and are trying to prepare our code base. Our existing groups and members will be imported to new groups on our new domain, and the existing group SID will be in the SID history of the newly created groups.

We currently use IsInRole to check user membership in groups. Does this method also check the SID history attribute? We have no way of populating the SID History attribute ourselves to test this.

active-directory .net c#
1 Answers

The source code for IsInRole is available. Lines 166 to 169 show how it works:

// CheckTokenMembership will check if the SID is both present and enabled in the access token.
if (!Interop.Advapi32.CheckTokenMembership((_identity.ImpersonationLevel != TokenImpersonationLevel.None ? _identity.AccessToken : token),
    sid.BinaryForm,
    ref isMember))

This looks for the group's SID in the access token of the user. The token is created when the user is authenticated and includes the SIDs of all security (not distribution) groups (and nested groups) that the user is a member of.

The documentation Using SID History to Preserve Resource Access says:

After migrating an account and maintaining the SID history of the source domain account, when a user logs on to the target domain, both the new SID and the original SID from the SID history attribute are added to the access token of the user and determine the local group memberships of the user. The SIDs of the groups in which the user is a member are then added to the access token, together with the SID history of those groups.

So that sounds like the SID history of both the user and the group are used when building the access token.

Gabriel Luci0
Related