Skip to content

Conversation

@chvancooten
Copy link
Contributor

@chvancooten chvancooten commented Feb 8, 2023

As proposed in #113, this PR implements changes in the delegation handling logic in computer.py and memberships.py. The changes implemented are as follows:

  • If the object is referenced by SID (check logic unchanged), the object is resolved via existing method resolve_sid().
  • If the object is referenced by another name, it is split and resolved by its samAccountName via resolve_samname().
    • Since we aren't sure of the exact samAccountName (could be USERNAME or COMPUTERNAME$ for example), the allow_filter flag was introduced to allow the use of LDAP wildcards in the resolve_samname() function.
    • The check for a period (".") in the name has been removed, since this could cause issues in cases where a user (not a FQDN) is allowed to delegate. To avoid duplicates (e.g. "HOST" and "HOST.fqdn" both appearing), a variable called delegatehosts_cache is introduced to keep track of hosts that have already been processed.
  • After resolving the object, the resolve_ad_entry() function is used to get the object's properties. If a samAccountName was used before, the resolved object properties are used to translate that back to its objectID.

Tested to work in my environment. Also tested with the latest version of bloodhound_import (fox-it/bloodhound-import@d52c24f), closing referencing PR fox-it/bloodhound-import#37.

image

dirkjanm added a commit that referenced this pull request Nov 28, 2023
Co-authored-by: Cas van Cooten <[email protected]>
@dirkjanm dirkjanm closed this Nov 28, 2023
@dirkjanm
Copy link
Owner

thanks Cas, took a while to get this tested and merged, but appreciate the work you did on this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants