如何按规范顺序对 SDDL DACL ace 进行排序？

Question

基于this我使用库https://github.com/Tirasa/ADSDDL来操作SDDL

implementation("net.tirasa:adsddl:1.9")

要启用标志

user cannot change password

，我使用以下代码行：

SDDLHelper.userCannotChangePassword(sddl, true)

但是当我访问 Windows ADAC（Active Directory 管理中心）时，我看到一条消息，指出我的 ace 未按规范顺序排列，它要求我重新排序。
结果我在 DACL 中得到了以下 ace：

P(OA;;[16];4c164200-20c0-11d0-a768-00aa006e0529;;S-1-5-21-1313564838-424579665-4250201628-553)
(OA;;[16];5f202010-79a5-11d0-9020-00c04fc2d4cf;;S-1-5-21-1313564838-424579665-4250201628-553)
(OA;;[16];bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;S-1-5-21-1313564838-424579665-4250201628-553)
(OA;;[16];037088f8-0ae1-11d2-b422-00a0c968f939;;S-1-5-21-1313564838-424579665-4250201628-553)
(OA;;WP[16];bf967a7f-0de6-11d0-a285-00aa003049e2;;S-1-5-21-1313564838-424579665-4250201628-517)
(OA;;[16];46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)
(OA;;WP[16];6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)
(OA;;WP[16];5805bc62-bdc9-4428-a5e2-856a0f4c185e;;S-1-5-32-561)
(OD;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;S-1-1-0)
(OD;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;S-1-5-10)
(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;S-1-5-10)
(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;S-1-5-10)
(OA;;[16];59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;S-1-5-11)
(OA;;[16];e48d0154-bcf8-11d1-8702-00c04fb96050;;S-1-5-11)
(OA;;[16];77b5b886-944a-11d1-aebd-0000f80367c1;;S-1-5-11)
(OA;;[16];e45795b3-9455-11d1-aebd-0000f80367c1;;S-1-5-11)
(OA;;WP[16];77b5b886-944a-11d1-aebd-0000f80367c1;;S-1-5-10)
(OA;;WP[16];e45795b2-9455-11d1-aebd-0000f80367c1;;S-1-5-10)
(OA;;WP[16];e45795b3-9455-11d1-aebd-0000f80367c1;;S-1-5-10)
(A;;WOWDRCSDCRWP[223];;;S-1-5-21-1313564838-424579665-4250201628-512)
(A;;WOWDRCSDCRWP[223];;;S-1-5-32-548)
(A;;RC;;;S-1-5-11)
(A;;RC[148];;;S-1-5-10)
(A;;WOWDRCSDCRWP[223];;;S-1-5-18)
(OA;CIIOID;[16];4c164200-20c0-11d0-a768-00aa006e0529;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)
(OA;CIID;[16];4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)
(OA;CIIOID;[16];5f202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)
(OA;CIID;[16];5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)
(OA;CIIOID;[16];bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)
(OA;CIID;[16];bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)
(OA;CIIOID;[16];59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)
(OA;CIID;[16];59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)
(OA;CIIOID;[16];037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)
(OA;CIID;[16];037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)
(OA;CIID;WP[16];5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-1313564838-424579665-4250201628-526)
(OA;CIID;WP[16];5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-1313564838-424579665-4250201628-527)
(OA;CIIOID;[8];9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-3-0)
(OA;CIIOID;[8];9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)
(OA;CIIOID;[16];b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-9)
(OA;CIIOID;[16];b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-9)
(OA;CIID;[16];b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-9)
(OA;CIIOID;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)
(OA;CIIOID;RC[148];;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)
(OA;CIIOID;RC[148];;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)
(OA;CIID;RC[148];;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)
(OA;CIIDOI;WP[16];3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;S-1-5-10)
(OA;CIID;CRWP[16];91e647de-d96f-4b70-9557-d63ff4f3ccd8;;S-1-5-10)
(A;CIID;WOWDRCSDCRWP[223];;;S-1-5-21-1313564838-424579665-4250201628-519)
(A;CIID;[4];;;S-1-5-32-554)
(A;CIID;WOWDRCSDCRWP[157];;;S-1-5-32-544)

我已经明白根本原因在于片段：

(OA;;WP[16];5805bc62-bdc9-4428-a5e2-856a0f4c185e;;S-1-5-32-561)
(OD;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;S-1-1-0)
(OD;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;S-1-5-10)
(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;S-1-5-10)

据我了解，所有

OD

应该在所有

OA

之前。但我想决定一般性问题并实施排序。在哪里可以找到所有排序规则？

我找到了这个，但我不明白那是什么：

Explicit ACEs
Deny ACEs
Regular ACEs
object ACEs

如何在代码中识别它们。

Answer 1

您实际上是在问如何在代码中识别这些类型。 您可以检查 SDDL 字符串中的模式/特定 ACE 类型。仅供参考，在 SDDL 中，拒绝 ACE 通常以“D:”开头，而允许 ACE 以“A:”开头。所以你检查前缀

我用 C++ 写了一个小演示，如下：

#include <iostream>
#include <algorithm>
#include <vector>

// Your ACE structure
struct ACE
{
    std::string type;        // "OA" -> Allow, "OD" -> Deny
    std::string rights;      // Access rights
    std::string objectType;  // Object type (optional - if applicable)
    std::string trustee;     // Trustee identifier
};

// Comparator function for sorting ACEs
bool compareACEs(const ACE& ace1, const ACE& ace2)
{
    // Use your own sorting here. This is just an example...
    if (ace1.type != ace2.type)
    {
        return ace1.type < ace2.type;
    }
    if (ace1.rights != ace2.rights)
    {
        return ace1.rights < ace2.rights;
    }
    return ace1.trustee < ace2.trustee;
}

int main()
{
    // Sample ACEs
    std::vector<ACE> aces = 
    {
        {"OA", "WP[16]", "", "S-1-5-32-561"},
        {"OD", "CR", "", "S-1-1-0"},
        {"OD", "CR", "", "S-1-5-10"},
        {"OA", "CR", "", "S-1-5-10"}
        // Here you can add more ACEs as needed
    };

    // Sort the ACEs using the compareACEs function where you put your own sorting
    // scheme.
    std::sort(aces.begin(), aces.end(), compareACEs);

    // our output
    for (const auto& ace : aces)
    {
        std::cout << "(" << ace.type << ";;" << ace.rights << ";" << ace.objectType << ";;" << ace.trustee << ")" << std::endl;
    }

    return 0;
}