@joebigelow / wix
Code Commits Issues Pulls Sessions CI/CD
main
main
cs 383 lines 16.8 KB
Raw
1 // Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information.
2
3 namespace WixTestTools
4 {
5 using System;
6 using System.Text;
7 using System.DirectoryServices;
8 using System.DirectoryServices.AccountManagement;
9 using System.Security.Principal;
10 using Xunit;
11
12 /// <summary>
13 /// Contains methods for User account verification
14 /// </summary>
15 public static class UserVerifier
16 {
17 public static class SIDStrings
18 {
19 // Built-In Local Groups
20 public static readonly string BUILTIN_ADMINISTRATORS = "S-1-5-32-544";
21 public static readonly string BUILTIN_USERS = "S-1-5-32-545";
22 public static readonly string BUILTIN_GUESTS = "S-1-5-32-546";
23 public static readonly string BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
24 public static readonly string BUILTIN_SERVER_OPERATORS = "S-1-5-32-549";
25 public static readonly string BUILTIN_PRINT_OPERATORS = "S-1-5-32-550";
26 public static readonly string BUILTIN_BACKUP_OPERATORS = "S-1-5-32-551";
27 public static readonly string BUILTIN_REPLICATOR = "S-1-5-32-552";
28
29 // Special Groups
30 public static readonly string CREATOR_OWNER = "S-1-3-0";
31 public static readonly string EVERYONE = "S-1-1-0";
32 public static readonly string NT_AUTHORITY_NETWORK = "S-1-5-2";
33 public static readonly string NT_AUTHORITY_INTERACTIVE = "S-1-5-4";
34 public static readonly string NT_AUTHORITY_SYSTEM = "S-1-5-18";
35 public static readonly string NT_AUTHORITY_Authenticated_Users = "S-1-5-11";
36 public static readonly string NT_AUTHORITY_LOCAL_SERVICE = "S-1-5-19";
37 public static readonly string NT_AUTHORITY_NETWORK_SERVICE = "S-1-5-20";
38 }
39
40 /// <summary>
41 /// Create a local user on the machine
42 /// </summary>
43 /// <param name="userName"></param>
44 /// <param name="password"></param>
45 /// <remarks>Has to be run as an Admin</remarks>
46 public static void CreateLocalUser(string userName, string password, string comment = "")
47 {
48 DeleteLocalUser(userName);
49 UserPrincipal newUser = new UserPrincipal(new PrincipalContext(ContextType.Machine));
50 newUser.SetPassword(password);
51 newUser.Name = userName;
52 newUser.Description = comment;
53 newUser.UserCannotChangePassword = true;
54 newUser.PasswordNeverExpires = false;
55 newUser.Save();
56 }
57
58 /// <summary>
59 /// Deletes a local user from the machine
60 /// </summary>
61 /// <param name="userName">user name to delete</param>
62 /// <remarks>Has to be run as an Admin</remarks>
63 public static void DeleteLocalUser(string userName)
64 {
65 UserPrincipal newUser = GetUser(String.Empty, userName);
66 if (null != newUser)
67 {
68 newUser.Delete();
69 }
70 }
71
72 /// <summary>
73 /// Verifies that a user exisits or not
74 /// </summary>
75 /// <param name="domainName">domain name for the user, empty for local users</param>
76 /// <param name="userName">the user name</param>
77 public static bool UserExists(string domainName, string userName)
78 {
79 UserPrincipal user = GetUser(domainName, userName);
80
81 return null != user;
82 }
83
84 /// <summary>
85 /// Sets the user information for a given user
86 /// </summary>
87 /// <param name="domainName">domain name for the user, empty for local users</param>
88 /// <param name="userName">the user name</param>
89 /// <param name="passwordExpired">user is required to change the password on first login</param>
90 /// <param name="passwordNeverExpires">password never expires</param>
91 /// <param name="disabled">account is disabled</param>
92 public static void SetUserInformation(string domainName, string userName, bool passwordExpired, bool passwordNeverExpires, bool disabled)
93 {
94 UserPrincipal user = GetUser(domainName, userName);
95
96 Assert.False(null == user, String.Format("User '{0}' was not found under domain '{1}'.", userName, domainName));
97 user.PasswordNeverExpires = passwordNeverExpires;
98 user.Enabled = !disabled;
99 if (passwordExpired)
100 {
101 user.ExpirePasswordNow();
102 }
103 else
104 {
105 // extend the expiration date to a month
106 user.AccountExpirationDate = DateTime.Now.Add(new TimeSpan(30, 0, 0, 0, 0));
107 }
108 user.Save();
109 }
110
111 /// <summary>
112 /// Sets the user comment for a given user
113 /// </summary>
114 /// <param name="domainName">domain name for the user, empty for local users</param>
115 /// <param name="userName">the user name</param>
116 /// <param name="comment">comment to be set for the user</param>
117 public static void SetUserComment(string domainName, string userName, string comment)
118 {
119 UserPrincipal user = GetUser(domainName, userName);
120
121 Assert.False(null == user, String.Format("User '{0}' was not found under domain '{1}'.", userName, domainName));
122
123 var directoryEntry = user.GetUnderlyingObject() as DirectoryEntry;
124 Assert.False(null == directoryEntry);
125 directoryEntry.Properties["Description"].Value = comment;
126 user.Save();
127 }
128
129 /// <summary>
130 /// Adds the specified user to the specified local group
131 /// </summary>
132 /// <param name="userName">User to add</param>
133 /// <param name="groupName">Group to add too</param>
134 public static void AddUserToGroup(string userName, string groupName)
135 {
136 DirectoryEntry localMachine;
137 DirectoryEntry localGroup;
138
139 localMachine = new DirectoryEntry("WinNT://" + Environment.MachineName.ToString());
140 localGroup = localMachine.Children.Find(groupName, "group");
141 Assert.False(null == localGroup, String.Format("Group '{0}' was not found.", groupName));
142 DirectoryEntry user = FindActiveDirectoryUser(userName);
143 localGroup.Invoke("Add", new object[] { user.Path.ToString() });
144 }
145
146 /// <summary>
147 /// Find the specified user in AD
148 /// </summary>
149 /// <param name="UserName">user name to lookup</param>
150 /// <returns>DirectoryEntry of the user</returns>
151 private static DirectoryEntry FindActiveDirectoryUser(string UserName)
152 {
153 var mLocalMachine = new DirectoryEntry("WinNT://" + Environment.MachineName.ToString());
154 var mLocalEntries = mLocalMachine.Children;
155
156 var theUser = mLocalEntries.Find(UserName);
157 return theUser;
158 }
159
160 /// <summary>
161 /// Verifies the user information for a given user
162 /// </summary>
163 /// <param name="domainName">domain name for the user, empty for local users</param>
164 /// <param name="userName">the user name</param>
165 /// <param name="passwordExpired">user is required to change the password on first login</param>
166 /// <param name="passwordNeverExpires">password never expires</param>
167 /// <param name="disabled">account is disabled</param>
168 public static void VerifyUserInformation(string domainName, string userName, bool passwordExpired, bool passwordNeverExpires, bool disabled)
169 {
170 UserPrincipal user = GetUser(domainName, userName);
171
172 Assert.False(null == user, String.Format("User '{0}' was not found under domain '{1}'.", userName, domainName));
173
174 Assert.True(passwordNeverExpires == user.PasswordNeverExpires, String.Format("Password Never Expires for user '{0}/{1}' is: '{2}', expected: '{3}'.", domainName, userName, user.PasswordNeverExpires, passwordNeverExpires));
175 Assert.True(disabled != user.Enabled, String.Format("Disappled for user '{0}/{1}' is: '{2}', expected: '{3}'.", domainName, userName, !user.Enabled, disabled));
176
177 DateTime expirationDate = user.AccountExpirationDate.GetValueOrDefault();
178 bool accountExpired = expirationDate.ToLocalTime().CompareTo(DateTime.Now) <= 0;
179 Assert.True(passwordExpired == accountExpired, String.Format("Password Expired for user '{0}/{1}' is: '{2}', expected: '{3}'.", domainName, userName, accountExpired, passwordExpired));
180 }
181
182 /// <summary>
183 /// Verifies the user comment for a given user
184 /// </summary>
185 /// <param name="domainName">domain name for the user, empty for local users</param>
186 /// <param name="userName">the user name</param>
187 /// <param name="comment">the comment to be verified</param>
188 public static void VerifyUserComment(string domainName, string userName, string comment)
189 {
190 UserPrincipal user = GetUser(domainName, userName);
191
192 Assert.False(null == user, String.Format("User '{0}' was not found under domain '{1}'.", userName, domainName));
193
194 var directoryEntry = user.GetUnderlyingObject() as DirectoryEntry;
195 Assert.False(null == directoryEntry);
196 Assert.True(comment == (string)(directoryEntry.Properties["Description"].Value));
197 }
198
199 /// <summary>
200 /// Verify that a given user is member of a local group
201 /// </summary>
202 /// <param name="domainName">domain name for the user, empty for local users</param>
203 /// <param name="userName">the user name</param>
204 /// <param name="groupNames">list of groups to check for membership</param>
205 public static void VerifyUserIsMemberOf(string domainName, string userName, params string[] groupNames)
206 {
207 IsUserMemberOf(domainName, userName, true, groupNames);
208 }
209
210 /// <summary>
211 /// Verify that a givin user is NOT member of a local group
212 /// </summary>
213 /// <param name="domainName">domain name for the user, empty for local users</param>
214 /// <param name="userName">the user name</param>
215 /// <param name="groupNames">list of groups to check for membership</param>
216 public static void VerifyUserIsNotMemberOf(string domainName, string userName, params string[] groupNames)
217 {
218 IsUserMemberOf(domainName, userName, false, groupNames);
219 }
220
221 /// <summary>
222 ///
223 /// </summary>
224 /// <param name="SID">SID to search for</param>
225 /// <returns>AccountName</returns>
226 public static string GetLocalUserNameFromSID(string sidString)
227 {
228 SecurityIdentifier sid = new SecurityIdentifier(sidString);
229 NTAccount account = (NTAccount)sid.Translate(typeof(NTAccount));
230 return account.Value;
231 }
232
233 /// <summary>
234 /// Get the SID string for a given user name
235 /// </summary>
236 /// <param name="Domain"></param>
237 /// <param name="UserName"></param>
238 /// <returns>SID string</returns>
239 public static string GetSIDFromUserName(string Domain, string UserName)
240 {
241 string retVal = null;
242 string domain = Domain;
243 string name = UserName;
244
245 if (String.IsNullOrEmpty(domain))
246 {
247 domain = System.Environment.MachineName;
248 }
249
250 try
251 {
252 DirectoryEntry de = new DirectoryEntry("WinNT://" + domain + "/" + name);
253
254 long iBigVal = 5;
255 byte[] bigArr = BitConverter.GetBytes(iBigVal);
256 System.DirectoryServices.PropertyCollection coll = de.Properties;
257 object obVal = coll["objectSid"].Value;
258 if (null != obVal)
259 {
260 retVal = ConvertByteToSidString((byte[])obVal);
261 }
262 }
263 catch (Exception ex)
264 {
265 retVal = String.Empty;
266 Console.Write(ex.Message);
267 }
268
269 return retVal;
270 }
271
272 /// <summary>
273 /// converts a byte array containing a SID into a string
274 /// </summary>
275 /// <param name="sidBytes"></param>
276 /// <returns>SID string</returns>
277 private static string ConvertByteToSidString(byte[] sidBytes)
278 {
279 short sSubAuthorityCount;
280 StringBuilder strSid = new StringBuilder();
281 strSid.Append("S-");
282 try
283 {
284 // Add SID revision.
285 strSid.Append(sidBytes[0].ToString());
286
287 sSubAuthorityCount = Convert.ToInt16(sidBytes[1]);
288
289 // Next six bytes are SID authority value.
290 if (sidBytes[2] != 0 || sidBytes[3] != 0)
291 {
292 string strAuth = String.Format("0x{0:2x}{1:2x}{2:2x}{3:2x}{4:2x}{5:2x}",
293 (short)sidBytes[2],
294 (short)sidBytes[3],
295 (short)sidBytes[4],
296 (short)sidBytes[5],
297 (short)sidBytes[6],
298 (short)sidBytes[7]);
299 strSid.Append("-");
300 strSid.Append(strAuth);
301 }
302 else
303 {
304 long iVal = (int)(sidBytes[7]) +
305 (int)(sidBytes[6] << 8) +
306 (int)(sidBytes[5] << 16) +
307 (int)(sidBytes[4] << 24);
308 strSid.Append("-");
309 strSid.Append(iVal.ToString());
310 }
311
312 // Get sub authority count...
313 int idxAuth = 0;
314 for (int i = 0; i < sSubAuthorityCount; i++)
315 {
316 idxAuth = 8 + i * 4;
317 uint iSubAuth = BitConverter.ToUInt32(sidBytes, idxAuth);
318 strSid.Append("-");
319 strSid.Append(iSubAuth.ToString());
320 }
321 }
322 catch (Exception ex)
323 {
324 Console.WriteLine(ex.Message);
325 return "";
326 }
327 return strSid.ToString();
328 }
329
330 /// <summary>
331 /// Verify that a given user is member of a local group
332 /// </summary>
333 /// <param name="domainName">domain name for the user, empty for local users</param>
334 /// <param name="userName">the user name</param>
335 /// <param name="shouldBeMember">whether the user is expected to be a member of the groups or not</param>
336 /// <param name="groupNames">list of groups to check for membership</param>
337 private static void IsUserMemberOf(string domainName, string userName, bool shouldBeMember, params string[] groupNames)
338 {
339 UserPrincipal user = GetUser(domainName, userName);
340 Assert.False(null == user, String.Format("User '{0}' was not found under domain '{1}'.", userName, domainName));
341
342 bool missedAGroup = false;
343 string message = String.Empty;
344 foreach (string groupName in groupNames)
345 {
346 try
347 {
348 bool found = user.IsMemberOf(new PrincipalContext(ContextType.Machine), IdentityType.Name, groupName);
349 if (found != shouldBeMember)
350 {
351 missedAGroup = true;
352 message += String.Format("User '{0}/{1}' is {2} a member of local group '{3}'. \r\n", domainName, userName, found ? String.Empty : "NOT", groupName);
353 }
354 }
355 catch (System.DirectoryServices.AccountManagement.PrincipalOperationException)
356 {
357 missedAGroup = true;
358 message += String.Format("Local group '{0}' was not found. \r\n", groupName);
359 }
360 }
361 Assert.False(missedAGroup, message);
362 }
363
364 /// <summary>
365 /// Returns the UserPrincipal object for a given user
366 /// </summary>
367 /// <param name="domainName">Domain name to look under, if Empty the LocalMachine is assumned as the domain</param>
368 /// <param name="userName"></param>
369 /// <returns>UserPrinicipal Object for the user if found, or null other wise</returns>
370 private static UserPrincipal GetUser(string domainName, string userName)
371 {
372 if (String.IsNullOrEmpty(domainName))
373 {
374 return UserPrincipal.FindByIdentity(new PrincipalContext(ContextType.Machine), IdentityType.Name, userName);
375 }
376 else
377 {
378 return UserPrincipal.Current;//.FindByIdentity(new PrincipalContext(ContextType.Domain,domainName), IdentityType.Name, userName);
379 }
380 }
381 }
382 }
383