<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"Segoe UI Semibold";
panose-1:2 11 7 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoAutoSig, li.MsoAutoSig, div.MsoAutoSig
{mso-style-priority:99;
mso-style-link:"E-mail Signature Char";
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.E-mailSignatureChar
{mso-style-name:"E-mail Signature Char";
mso-style-priority:99;
mso-style-link:"E-mail Signature";
font-family:"Calibri",sans-serif;}
span.EmailStyle23
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Douglas,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">After researching this [MS-DTYP] question, I’ve determined that the difference between a sid-array and a literal-SID is a trailing [wspace].<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is my logic:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Member_of general definition: ("Member_of") [wspace] sid-array<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">SID array general definition: sid-array = literal-SID [wspace] / "{" [wspace] literal-SID [wspace] *( "," [wspace] literal-SID [wspace]) "}"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">SID array with single element: sid-array = literal-SID [wspace]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Alternate SID array with single element: sid-array = "{" [wspace] literal-SID [wspace] "}"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">literal-SID = "SID(" sid-string ")"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>Using a SID array with single element: ("Member_of") [wspace] "SID(" sid-string ")" [wspace]<o:p></o:p></b></p>
<p class="MsoNormal"><b>Alt SID array with single element: ("Member_of") [wspace] "{" [wspace] "SID(" sid-string ")" [wspace] "}"<o:p></o:p></b></p>
<p class="MsoNormal">Hypothetical, using single literal SID: ("Member_of") [wspace] "SID(" sid-string ")"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The document dictates the use of a sid-array for “Member_of”, regardless of the number of elements in the array. This would mean using curly braces with [wspace] padding, or using the trailing [wspace], as bolded above. If you believe that
example 3 needs to be altered, please let me know what would enable better clarity.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for your patience,<o:p></o:p></p>
<p class="MsoNormal">Kristian<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="color:black"></span><span style="font-size:10.0pt;font-family:"Segoe UI Semibold",sans-serif;color:#222A35">Kristian Smith</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:#737373">Support Escalation Engineer</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:#737373">Windows Open Spec Protocols</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:#737373">Office: (425) 421-4442</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:black"><a href="mailto:kristian.smith@microsoft.com">kristian.smith@microsoft.com</a></span><span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:#737373">
</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Kristian Smith <Kristian.Smith@microsoft.com> <br>
<b>Sent:</b> Thursday, December 29, 2022 12:13 PM<br>
<b>To:</b> Douglas Bagnall <douglas.bagnall@catalyst.net.nz>; cifs-protocol@lists.samba.org<br>
<b>Cc:</b> Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> Re: [EXTERNAL] [MS-DTYP] conditional ACE SDDL sid arrays - TrackingID#2212170040000207<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="color:black;background:white">Hi Douglas,</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black;background:white">I'll be looking into this issue for you. I'll reach out when I have more information.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black;background:white">Thanks, <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:black;background:white">Kristian<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="font-size:10.0pt;font-family:"Segoe UI Semibold",sans-serif;color:#222A35">Kristian Smith</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:#737373">Support Escalation Engineer</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:#737373">Windows Open Spec Protocols</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:#737373">Office: (425) 421-4442</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;background:white">
<span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:black"><a href="mailto:kristian.smith@microsoft.com">kristian.smith@microsoft.com</a></span><span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:#737373">
</span><o:p></o:p></p>
<p class="MsoAutoSig"> <o:p></o:p></p>
</div>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Jeff McCashland (He/him) <<a href="mailto:jeffm@microsoft.com">jeffm@microsoft.com</a>><br>
<b>Sent:</b> Friday, December 16, 2022 8:17 PM<br>
<b>To:</b> Douglas Bagnall <<a href="mailto:douglas.bagnall@catalyst.net.nz">douglas.bagnall@catalyst.net.nz</a>>;
<a href="mailto:cifs-protocol@lists.samba.org">cifs-protocol@lists.samba.org</a> <<a href="mailto:cifs-protocol@lists.samba.org">cifs-protocol@lists.samba.org</a>><br>
<b>Cc:</b> Microsoft Support <<a href="mailto:supportmail@microsoft.com">supportmail@microsoft.com</a>><br>
<b>Subject:</b> RE: [EXTERNAL] [MS-DTYP] conditional ACE SDDL sid arrays - TrackingID#2212170040000207</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">[DocHelp to BCC, support on CC, SR ID on Subject]<br>
<br>
Hi Douglas,<br>
<br>
Thank you for the question. We have created SR 2212170040000207 to track this issue. One of our engineers will respond soon to assist.<br>
<br>
Best regards,<br>
Jeff McCashland (He/him) | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team<br>
Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada)<br>
Local country phone number found here: <a href="https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsupport.microsoft.com%2Fglobalenglish&data=05%7C01%7CKristian.Smith%40microsoft.com%7Cbe1d030b363846bddf0608dadfe596a5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638068474415736250%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=yqLDjLspa7ij01PgRGElgxnlZXy%2FJmAHok%2FTdv%2BQxWo%3D&reserved=0">
https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsupport.microsoft.com%2Fglobalenglish&data=05%7C01%7CKristian.Smith%40microsoft.com%7Cbe1d030b363846bddf0608dadfe596a5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638068474415736250%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=yqLDjLspa7ij01PgRGElgxnlZXy%2FJmAHok%2FTdv%2BQxWo%3D&reserved=0</a>
| Extension 1138300<br>
<br>
-----Original Message-----<br>
From: Douglas Bagnall <<a href="mailto:douglas.bagnall@catalyst.net.nz">douglas.bagnall@catalyst.net.nz</a>><br>
Sent: Friday, December 16, 2022 6:02 PM<br>
To: Interoperability Documentation Help <<a href="mailto:dochelp@microsoft.com">dochelp@microsoft.com</a>>;
<a href="mailto:cifs-protocol@lists.samba.org">cifs-protocol@lists.samba.org</a><br>
Subject: [EXTERNAL] [MS-DTYP] conditional ACE SDDL sid arrays<br>
<br>
hi Dochelp,<br>
<br>
I am working on conditional ACES for Samba. The documentation is mostly very clear, but I have one question prompted by example 3 in 2.4.4.19, which deals with the encoding of this SDDL snippet:<br>
<br>
> (@User.clearanceLevel><a href="mailto:=@Resource.requiredClearance">=@Resource.requiredClearance</a>) ||<br>
> (Member_of{SID(BA)})<br>
<br>
where the 'Member_of{SID(BA)}' becomes a composite token containing the single SID, followed by the Member_of operator. So far this makes sense.<br>
<br>
However, earlier, in 2.4.4.17.6 ('Relational Operator Tokens') we have<br>
<br>
> The operand type MUST be either a SID literal, or a composite, each of<br>
> whose elements is a SID literal.<br>
<br>
which is also clear. But the ABNF in 2.5.1.1 ('Syntax') look like<br>
<br>
> memberof-op = ( "Member_of" / ... ) wspace sid-array<br>
<br>
and sid-array is<br>
<br>
> sid-array = literal-SID [wspace] / "{" [wspace] literal-SID [wspace] *( "," [wspace] literal-SID [wspace]) "}"<br>
<br>
so *syntactically*, this (a literal-SID without the curly brackets)<br>
<br>
(Member_of SID(BA))<br>
<br>
would also refer to a sid-array. Thus here's the question: would this last form be compiled as a composite value (as implied by "sid-array") or would it be a solitary SID?<br>
<br>
And if doesn't result in a solitary SID, how would such a SID be represented in SDDL, or is that not possible?<br>
<br>
The wider question is whether, for valid conditonal aces, an ACE -> SDDL -> ACE cycle should always end up at the same point as the original.<br>
<br>
As a side-note, the example omits the wspace in memberof-op. I suspect the ABNF is inexact, but it might be fiddly to fix because I don't know if '[wspace]'<br>
would work for the form without {}.<br>
<br>
cheers,<br>
Douglas<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>