1

问题

如何可靠地判断给定的字符串是代表 aNTAccount还是 a SecurityIdentifier？

详细

给定一个字符串，我可以通过构造函数将其转换为 anNTAccount或 a ：SecurityIdentifier

[string]$myAccount = '...' # some value
$ntAccount = [System.Security.Principal.NTAccount]::new($myAccount)
$sid = [System.Security.Principal.SecurityPrincipal]::new($myAccount) // throws exception if not a valid SID

如果字符串不是 SID，SecurityIdentifier 构造函数将抛出异常。如果字符串是 SID，NTAccount 构造函数将接受它......但是，当我尝试将其转换为 SID 时，System.Security.Principal.IdentityNotMapped将引发异常。

$sidFromNT = $ntAccount.Translate([System.Security.Principal.SecurityPrincipal]) # throw exception
$ntFromSid = $sid.Translate([System.Security.Principal.NTAccount]) # should work as if the SID were invalid we'd have already erred

如果我可以说我不知道​​使用共享基类的类型，那就太好了；但那是抽象的/没有公共构造函数；所以我不能这样做：

[string]$account = '...'
$idRef = [System.Security.Principal.IdentityReference]::new($account) # this is not valid code
$ntFromId = $idRef.Translate([System.Security.Principal.NTAccount])
$sidFromId = $idRef.Translate([System.Security.Principal.SecurityIdentifier])

因此，我能想到的唯一选择是：

  • 使用抛出的错误*来确定类型；但这使错误成为我正常流程的一部分。
  • 检查值是否开始S-；非常快，在大多数情况下应该可以工作；但这是一个黑客。

* 注意：我意识到无效值（即既不是 NT 帐户也不是 SID）也会出现异常；为了保持简短，我暂时忽略了这种情况。

--

C#版本

由于这是一个 .net 问题，而不是特定于 PowerShell 的问题，因此这里的代码用于说明 C# 中的相同问题（遗憾的是，我无法解决这个问题，因为各种 Fiddle 站点限制了所需的功能）。

public static void Main()
{
    var ids = new string[] {"S-1-1-0", "Everyone"}; // a list of values which may be SIDs or NTAccounts
    var pseudoRandomIndex = DateTime.Now.Millisecond % ids.Length; // saves initialising Random for a simple demo
    var idString = ids[pseudoRandomIndex]; // pick one id at random; be it a SID or an NT Account

    Debug.WriteLine($"Selected value is {idString}");

    TryToProcessIdentityReference<NTAccount, SecurityIdentifier>(idString, (id) => new NTAccount(id));
    TryToProcessIdentityReference<SecurityIdentifier, NTAccount>(idString, (id) => new SecurityIdentifier(id));
}

static void TryToProcessIdentityReference<T1, T2>(string idString, Func<string, T1> callConstructor)
    where T1 : IdentityReference
    where T2 : IdentityReference
{
    var t1Type = typeof(T1);
    var t2Type = typeof(T2);
    Console.WriteLine($"Trying to process {idString} as a {t1Type.Name} ...");
    try 
    {
        var t1 = callConstructor(idString);
        _ = t1.Translate(t2Type); 
        Debug.WriteLine($" - {idString} is a valid {t1Type.Name}!");
    } catch (Exception e) when(e is ArgumentException || e is IdentityNotMappedException) { 
        Debug.WriteLine($" - Failed to process {idString} as {t1Type.Name}; error thrown when translating to {t2Type.Name}");
        Debug.WriteLine($" - {e.ToString()}");
    }   
}
4

2 回答 2

2

也许结合 try..catch 块对您来说是可以接受的：

[string]$myAccount = '...' # some value

try {
    # test if string $myAccount is an account name
    if ($myAccount.Contains("\")) {
        $domain, $user = $myAccount.Split("\", 2)
    }
    else { 
        $domain = $env:USERDOMAIN
        $user   = $myAccount
    }
    $ntAccount = [System.Security.Principal.NTAccount]::new($domain, $user)
    $sid = [System.Security.Principal.NTAccount]::new($ntAccount).Translate([System.Security.Principal.SecurityIdentifier]).Value
    # output something
    "'$myAccount' is an account name:`r`nNT Account: $ntAccount`r`nSID: $sid"
}
catch {
    # try if string $myAccount is a SID
    if ($myAccount -like 'S-1-15-3*') {
        Write-Warning "SID '$myAccount' is a Capability type SID and cannot be resolved."
    }
    else {
        try {
            $ntAccount = [System.Security.Principal.SecurityIdentifier]::new($myAccount).Translate([System.Security.Principal.NTAccount]).Value
            "'$myAccount' is a SID:`r`nNT Account: $ntAccount`r`nSID: $myAccount"
        }
        catch {
            Write-Warning "'$myAccount' could not be identified."
        }
    }
}
于 2020-04-26T12:31:15.787 回答
1

我意识到我可以使用as而不是构造函数来避免捕获异常。

PowerShell 版本

[string]$idString = @('Everyone', 'S-1-1-0') | Get-Random -Count 1
[System.Security.Principal.IdentityReference]$idRef = $idString -as [System.Security.Principal.SecurityIdentifier]
if ($null -eq $idRef) {
    $idRef = $idString -as [System.Security.Principal.NTAccount]
}
"Input     = $idString"
"SID       = $($idRef.Translate([System.Security.Principal.SecurityIdentifier]).Value)"
"NTAccount = $($idRef.Translate([System.Security.Principal.NTAccount]).Value)"

C#版本

注意：as关键字在 C# 场景中无效，所以我上面的解决方案是特定于语言的......

我想出的最好的方法是将错误流封装在它自己的函数中，这样一旦解决方案可用，我们就可以轻松地改进事情。

public static void Main()
{
    var ids = new string[] {"S-1-1-0", "Everyone"}; // a list of values which may be SIDs or NTAccounts
    var pseudoRandomIndex = DateTime.Now.Millisecond % ids.Length; // saves initialising Random for a simple demo
    var idString = ids[pseudoRandomIndex]; // pick one id at random; be it a SID or an NT Account

    var idRef = TryParse(idString, out var temp) ? (IdentityReference)temp : (IdentityReference)new NTAccount(idString);
    Debug.WriteLine($"Selected value is {idString}");
    Debug.WriteLine($"SID:              {idRef.Translate(typeof(SecurityIdentifier))}");
    Debug.WriteLine($"NTAccount:        {idRef.Translate(typeof(NTAccount))}");
}

public static bool TryParse(string value, out SecurityIdentifier result) 
{
    try 
    {
        result = new SecurityIdentifier(value);
        return true;
    } 
    catch (ArgumentException) 
    {
        result = null;
        return false;
    }
}
于 2020-04-26T12:36:52.203 回答