C# .NET 核心：将身份参考 SID 转换为 Active Directory 组和用户的显示值

Question

I'm switching an API from .NET Framework to .NET Core and running into some differences in the behavior of Directory.Services.AccountManagement vs System.IO.FileSystem.AccessControl in .NET Core 3.1.

The issue in the .NET Core code is I'm trying to get the Active Directory group name (or user name) for each rule for a file. I can get the sid, but the FileSystemAccessRule.IdentifyReference.Translate() method throws an exception for AD groups.

Here's what I have: I can get the SID in the id variable, but I need the actual group name (or user name)

using System.Security.AccessControl;
using System.Security.Principal;

namespace ConsoleCoreAclsPoc
{
    class Program
    {
        static void Main(string[] args)
        {
            var fn = args[0];

            var rules = new FileSecurity(fn, AccessControlSections.All | AccessControlSections.Access)
                               .GetAccessRules(true,true,typeof(NTAccount));

            foreach (AuthorizationRule rule in rules)
            {
                FileSystemAccessRule fileRule = rule as FileSystemAccessRule;

                if (fileRule != null)
                {
                    var id = fileRule.IdentityReference;//.Translate(typeof(NTAccount));
                    var read = fileRule.FileSystemRights.HasFlag(FileSystemRights.ReadAndExecute);
                    var write = fileRule.FileSystemRights.HasFlag(FileSystemRights.Modify);
                    var admin = fileRule.FileSystemRights.HasFlag(FileSystemRights.FullControl);

                    if (!admin)
                    {
                        // do stuff to the non-admins
                    }
                }
            }
        }
    }
}

Answer 1

I tested your code and found an exception in Access Control Sections. The compiler does not allow access to all security When you want to access the permissions of a file. Change AccessControlSections to AccessControlSections.Access . Then I did not find any error.

var rules = new FileSecurity(fn, AccessControlSections.Access)
             .GetAccessRules(true, true, typeof(NTAccount));