CODEWITHSUNDEEP
vb.netsecurityactive-directory
Stephan B
Stephan B

Reputation: 3701

How to validate the active directory domain my app is running in?

I have a VB.Net Application that authenticates using the current Windows User without asking for the password. It checks that this user is a member of "MYDOMAIN\ApplicationUsers" before it starts up.

How to check if this is the real domain and not a different one using the same name? Are there any certs or public keys to validate locally? I'd prefer to check this offline, without a third party machine or database etc.

In the System.DirectoryServices.ActiveDirectory Namespace are some Trust an Validate methods but they only seem to check inter domain trust and using a domain name only.

Upvotes: 7

Views: 680

Answers (2)

Georg Jung
Georg Jung

Reputation: 1167

I made some example code which checks the group's SID as Mike suggested. You just need to put your group's SID in the constructor of the SecurityIdentifier class to make the check work against the currently logged on user.

Private Sub DoCheck()
    Dim sid As New Security.Principal.SecurityIdentifier("S-0-0-00-0000000000-0000000000-0000000000-000"),
        result As Boolean
    result = IsUserInGroup(sid)
End Sub

Public Shared Function IsUserInGroup(sid As Security.Principal.SecurityIdentifier) As Boolean
    Dim user As UserPrincipal
    user = UserPrincipal.Current
    For Each group As Principal In user.GetGroups()
        If group.Sid.Equals(sid) Then Return True
    Next
    Return False
End Function

To make the code work you need to import System.DirectoryServices.AccountManagement:

Imports System.DirectoryServices.AccountManagement

This namespace is located in Microsoft's System.DirectoryServices.AccountManagement.dll which is available since .Net 4.0 I believe.

Upvotes: 1

Mike
Mike

Reputation: 3460

Your problem is that you are using strings and strings like mydomain/application users are not unique across domains. One possibility is to use the SID of the application users group in your expected domain instead of the name. Then you can check the SID of the group to make sure it matches the sid for the expected application users group at run time before checking membership. It would be much harder for a malicious user to spoof domain and group parts of the Sid then the domain and group name.

Ultimately if you are running code on a machine that is owned by the malicious user then this just raises the bar and they could still circumvent this check.

Upvotes: 1

Related Questions