Determine NT groups if in hierarchy?

[gary.comstock]

We have setup 4 NT groups - Executive, Manager, Employee and
Contractor. The premise is that an Executive has all of the privileges
of Itself plus Manager plus Employee plus Contractor while an Employee
only has itself and Contractor.

We did this as a hierarchy where the higher (i.e. Executive) has a
member of the one directly below (i.e. Manager):

Executive has a member of Manager
Manager has a member of Employee
Employee has a member of Contractor
Contractor

Using .NET 2.0 we are using Page.User.Ident ity.Name to determine the
user and from there can determine the NT groups in which they belong by
using the following:

// Display the SIDs for the groups the current user belongs.
Response.Write( "<br>Displa y the SIDs for the groups the current user
belongs");
WindowsIdentity wi = User.Identity as WindowsIdentity ;
Response.Write( "<br>");
Response.Write( "Is Authenticated=" + wi.IsAuthentica ted);
Response.Write( "<br>");
// Display the SID for the owner.
Response.Write( "The SID for the owner is : ");
SecurityIdentif ier si = wi.Owner;
Response.Write( si.ToString());
StringCollectio n roles = new StringCollectio n();
foreach (IdentityRefere nce group in wi.Groups)
{
Response.Write( "<br>" + group.Value);
string role =
((NTAccount)gro up.Translate(ty peof(NTAccount) )).Value;
Response.Write( " - " + role.ToString() );
}

If I set myself up in the Manager group and run the code above I see
that I'm a member of the Manager group. The problem is that I need to
check to make sure I'm a member of the Employee group but how would I
go about doing this? Do I write code that somehow traverses the groups
or will NT handle this? Since theoretically if I'm a member of the
Manager then if we setup the groups correctly I should also be a member
of Employee and Contractor. We're attempting Impersonation/Delegation
against a database.
Thanks,
Gary

[OHM]

Easy to test. Set youself up as a member of the emloyees group and then if
this is a member of the managers group,. If NT were to apply its
hierarchical membership method you would be a member of managers by default.
However, I dont think ( and I may be wrong ) that this works in this fashion
for the purposes of ASP.NET I would be interested to try that though.

Post back and let us know how you got on

--

Best Regards - OHM

http://TrainingOn.net
--------------------------------------------------
<ga***********@ gmail.comwrote in message
news:11******** **************@ j72g2000cwa.goo glegroups.com.. .

We have setup 4 NT groups - Executive, Manager, Employee and
Contractor. The premise is that an Executive has all of the privileges
of Itself plus Manager plus Employee plus Contractor while an Employee
only has itself and Contractor.

We did this as a hierarchy where the higher (i.e. Executive) has a
member of the one directly below (i.e. Manager):

Executive has a member of Manager
Manager has a member of Employee
Employee has a member of Contractor
Contractor

Using .NET 2.0 we are using Page.User.Ident ity.Name to determine the
user and from there can determine the NT groups in which they belong by
using the following:

// Display the SIDs for the groups the current user belongs.
Response.Write( "<br>Displa y the SIDs for the groups the current user
belongs");
WindowsIdentity wi = User.Identity as WindowsIdentity ;
Response.Write( "<br>");
Response.Write( "Is Authenticated=" + wi.IsAuthentica ted);
Response.Write( "<br>");
// Display the SID for the owner.
Response.Write( "The SID for the owner is : ");
SecurityIdentif ier si = wi.Owner;
Response.Write( si.ToString());
StringCollectio n roles = new StringCollectio n();
foreach (IdentityRefere nce group in wi.Groups)
{
Response.Write( "<br>" + group.Value);
string role =
((NTAccount)gro up.Translate(ty peof(NTAccount) )).Value;
Response.Write( " - " + role.ToString() );
}

If I set myself up in the Manager group and run the code above I see
that I'm a member of the Manager group. The problem is that I need to
check to make sure I'm a member of the Employee group but how would I
go about doing this? Do I write code that somehow traverses the groups
or will NT handle this? Since theoretically if I'm a member of the
Manager then if we setup the groups correctly I should also be a member
of Employee and Contractor. We're attempting Impersonation/Delegation
against a database.
Thanks,
Gary

[gary.comstock]

It actually worked! NT traversed the the groups and displayed all of
the member groups.

Gary

OHM wrote:

Easy to test. Set youself up as a member of the emloyees group and then if
this is a member of the managers group,. If NT were to apply its
hierarchical membership method you would be a member of managers by default.
However, I dont think ( and I may be wrong ) that this works in this fashion
for the purposes of ASP.NET I would be interested to try that though.

Post back and let us know how you got on

--

Best Regards - OHM

http://TrainingOn.net
--------------------------------------------------
<ga***********@ gmail.comwrote in message
news:11******** **************@ j72g2000cwa.goo glegroups.com.. .

We have setup 4 NT groups - Executive, Manager, Employee and
Contractor. The premise is that an Executive has all of the privileges
of Itself plus Manager plus Employee plus Contractor while an Employee
only has itself and Contractor.

We did this as a hierarchy where the higher (i.e. Executive) has a
member of the one directly below (i.e. Manager):

Executive has a member of Manager
Manager has a member of Employee
Employee has a member of Contractor
Contractor

Using .NET 2.0 we are using Page.User.Ident ity.Name to determine the
user and from there can determine the NT groups in which they belong by
using the following:

// Display the SIDs for the groups the current user belongs.
Response.Write( "<br>Displa y the SIDs for the groups the current user
belongs");
WindowsIdentity wi = User.Identity as WindowsIdentity ;
Response.Write( "<br>");
Response.Write( "Is Authenticated=" + wi.IsAuthentica ted);
Response.Write( "<br>");
// Display the SID for the owner.
Response.Write( "The SID for the owner is : ");
SecurityIdentif ier si = wi.Owner;
Response.Write( si.ToString());
StringCollectio n roles = new StringCollectio n();
foreach (IdentityRefere nce group in wi.Groups)
{
Response.Write( "<br>" + group.Value);
string role =
((NTAccount)gro up.Translate(ty peof(NTAccount) )).Value;
Response.Write( " - " + role.ToString() );
}

If I set myself up in the Manager group and run the code above I see
that I'm a member of the Manager group. The problem is that I need to
check to make sure I'm a member of the Employee group but how would I
go about doing this? Do I write code that somehow traverses the groups
or will NT handle this? Since theoretically if I'm a member of the
Manager then if we setup the groups correctly I should also be a member
of Employee and Contractor. We're attempting Impersonation/Delegation
against a database.
Thanks,
Gary