From f893cf85cc387b66c496661e11073b1215270022 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 23 Aug 2023 12:04:29 +1200 Subject: [PATCH] security.idl: extend security token for claims A security token contains the context needed to make access decisions for a particular client, which has until now been a number of SIDs and flags. Claims are arbitrary attributes that can be tacked onto the security token. Typically they will arrive via a Kerberos PAC, but we don't need to worry about that now -- only that they are stored on the token. The security token in [MS-DTYP] 2.5.2 is described in abstract terms (it is not transmitted on the wire) as behaving *as if* it held claims in three arrays of CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 structures. We take that suggestion literally. This is *almost* the same as storing the [MS-ADTS] 2.2.18 claims wire structures that the claims are presumably derived from, and doing that might seem like a small optimisation. But we don't do that because of subtle differences and we already need CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 in security.idl for resource attribute ACEs. The three stored claim types are user claims, device claims, and local claims. Local claims relate to local Windows accounts and are unlikely to occur in Samba. Nevertheless we have the array there just in case. Signed-off-by: Douglas Bagnall Reviewed-by: Andrew Bartlett Autobuild-User(master): Andrew Bartlett Autobuild-Date(master): Thu Sep 7 05:50:24 UTC 2023 on atb-devel-224 --- librpc/idl/security.idl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl index b3bc834a94c..20ff02f0074 100644 --- a/librpc/idl/security.idl +++ b/librpc/idl/security.idl @@ -758,6 +758,12 @@ interface security [size_is(num_sids)] dom_sid sids[*]; se_privilege privilege_mask; lsa_SystemAccessModeFlags rights_mask; + uint32 num_local_claims; + uint32 num_user_claims; + uint32 num_device_claims; + [size_is(num_local_claims)] CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 local_claims[*]; + [size_is(num_user_claims)] CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 user_claims[*]; + [size_is(num_device_claims)] CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 device_claims[*]; } security_token; typedef [public] struct { -- 2.47.3