search

Macmod / godap

A complete TUI for LDAP.
MIT License
209 stars 7 forks source link

Creation of "Deny" ACEs in the DACL editor makes the DACL out-of-order #11

Closed Macmod closed 2 weeks ago

Macmod commented 2 weeks ago

Apparently the order of ACEs isn't automatically inferred by Active Directory and if you create a "Deny" ACE below an "Allow" ACE it's created as-is, making the ACL out of order. If you then view the Security tab manually in the AD, it prompts the admin to "Re-order" the ACL.

Macmod commented 2 weeks ago

Considering that Microsoft's docs state that Within the group of explicit ACEs, access-denied ACEs are placed before access-allowed ACEs, I believe we can just prepend Deny ACEs upon creation and keep the current behavior of appending Allow ACEs.