<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Ndaya,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal">>Does Validated-SPN validated write allow an account to set an object's SPN to the following values:<br>
>HOST/samAccountName (without the "$")<br>
>HOST/dnsDomainName<br>
>if the object is a regular computer object and NOT a DC?<br>
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060">ANS: Since they are two part SPNs, they should be allowed to be written to the ServicePrincipleName attribute based on Validated-SPN access right , as
per MS-DRSR 5.5 (for DRS) and MS-ADTS 3.1.1.5.3.1.1.4 (for LDAP). If you look closely at the algorithm you referenced, it is the same as the AccessCheckWriteToSpnAttribute in DRSR. It means that the SPN is a correct two-part SPN , OR SPN is a correct
three-part SPN and the object is a DC’s domain controller object. It basically allows the three part SPN only on Domain Controllers. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">>In addition, I did the following test:<br>
>Gave Validated-SPN right to a user on a regular computer object, and got CONSTRAINT_VIOLATION when setting its servicePrincipalName with the above described values.<br>
>Gave Validated-SPN right to a user on a DC object, and these values were set successfully.<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060">ANS: I did the similar testing to set the servicePrincipleName to the two part SPN on a non-DC computer object and I don’t see any error. If I set a three
part SPN on non-DC computer object , then I receive a CONSTRAINT_VIOLATION error. There is no error if I set either form of the SPN on a DC object. The result matches the logic in the documents. I used one account that doesn’t have RIGHT_DS_WRITE_PROPERTY
right, but has only RIGHT_DS_WRITE_PROPERTY_EXTENDED right with Object type set to ServicePrincipleName. I got the same result when I use an admin account that has all the rights. Could you share more information about your testing ?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal">>Is the behavior of setting servicePrincipalName supposed to be different between LDAP and DRS?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">ANS: Yes, it should the same , see the answer above.
</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060">The DRSR replication routine will use the same logic as LDAP modify operation to modify the object attribute, so the object access control logic is the same. The AccessCheckAttr
(5.2 MS-DRSR) just refers to the related sections in MS-ADTS.<o:p></o:p></span></p>
<p class="MsoNormal"><br>
>Does servicePrincipalName modification depend on things other then the syntax restrictions described in MS-DRSR and MS-ADTS?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">ANS: Besides the constraint as a validate write (3.1.1.5.3.1.1.4 MS-ADTS), it should also meet the constraint for being a modify operation as in 3.1.1.5.3.2
MS-ADTS. <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
>If an object does not have Validated-SPN on Principal-Self, should the account still be allowed to set the above values via DRS?<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">ANS: Any SID substitution for Principal Self should be performed before any access checking behavior (5.1.3.3. MS-ADTS), thus the real user SID will not
have Validated-SPN right if the Principal Self doesn’t have it. It should not be allowed to set servicePrincipleName via either DRSR or LDAP since this is a mandatory requirement for the requester to have a Validated-SPN right.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Please let me know if this makes sense and if you have more questions.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hongwei<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> cifs-protocol-bounces@cifs.org [mailto:cifs-protocol-bounces@cifs.org]
<b>On Behalf Of </b>Nadezhda Ivanova<br>
<b>Sent:</b> Friday, December 17, 2010 5:08 AM<br>
<b>To:</b> Interoperability Documentation Help<br>
<b>Cc:</b> cifs-protocol@samba.org<br>
<b>Subject:</b> [cifs-protocol] Questions about Validated-SPN validated write<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hello,<br>
Does Validated-SPN validated write allow an account to set an object's SPN to the following values:<br>
HOST/samAccountName (without the "$")<br>
HOST/dnsDomainName<br>
if the object is a regular computer object and NOT a DC?<br>
<br>
The algorithm described in MS-DRSR 5.5 AccessCheckWriteToSpnAttribute seems to indicate that yes, this should be allowed. Ot the other hand, MS-ADTS 3.1.1.5.3.1.1.4 servicePrincipalName leads me to believe that the object being a DC is mandatory constraint:
"The SPN is a syntactically correct two-part SPN, or it is a syntactically correct three-part SPN (see<br>
Mutual Authentication (section 5.1.1.4)) and the object is a DC’s domain controller object (see<br>
sections7.1.1.3.1 and 7.1.1.3.2). "<br>
<br>
In addition, I did the following test:<br>
Gave Validated-SPN right to a user on a regular computer object, and got CONSTRAINT_VIOLATION when setting its servicePrincipalName with the above described values.<br>
Gave Validated-SPN right to a user on a DC object, and these values were set successfully.<br>
<br>
So my questions are:<br>
Is the behaviour of setting servicePrincipalName supposed to be different between LDAP and DRS?<br>
Does servicePrincipalName modification depend on things other then the syntax restrictions described in MS-DRSR and MS-ADTS?<br>
If an object does not have Validated-SPN on Principal-Self, should the account still be allowed to set the above values via DRS?<br>
<br>
Best Regards,<br>
Nadezhda Ivanova<o:p></o:p></p>
</div>
</body>
</html>