Share via

3.3.5.7.3 Domain Local Group Membership

  • Article

Groups can be created so that they are only visible to servers in the same domain. For every service ticket that is issued during a TGS request, except for cross-realm TGTs, the KDC MUST populate the PAC with domain local group membership for the user.

For KILE implementations that use Active Directory for the account database, KDCs MUST call the GetResourceDomainInfo procedure ([MS-ADTS] section 3.1.1.13.4) where:

  • InputSids is an array of SIDs that identify the user and also the groups, contained in GroupIds ([MS-PAC] section 2.2.2 and section 2.5), that the user is a member of.

    Note that each SID is calculated as follows:

    • For the user, the SID contains the SID of the user created by concatenating LogonDomainId  and UserId.

    • For each account domain group, the SID contains the SID of the group created by concatenating LogonDomainId and GroupIds.RelativeID.

    • For each group in other domains, the SID contains ExtraSids.Sid.

Then the KDC MUST copy the populated fields from the PAC in the TGT to the newly created PAC and add to the KERB_VALIDATION_INFO structure ([MS-PAC] section 2.5) of the new PAC the domain local groups that are returned by the GetResourceDomainInfo procedure to the existing fields as follows:

  • If the Resource-SID-compression-disabled bit is not set in the Application Server's service account's KerbSupportedEncryptionTypes and not set in the krbtgt's account's KerbSupportedEncryptionTypes:<69>

    • The ResourceGroupDomainSid field contains the SID for the domain.

    • The ResourceGroupCount field contains the number of groups in the ResourceGroupIds field.

    • The ResourceGroupIds field contains the pointer to a list which is the list copied from the PAC in the TGT plus a list constructed from the domain local groups (GROUP_MEMBERSHIP [MS-PAC] section 2.2.2) where:

      • RelativeId contains the RID of the value from the ResourceSids parameter ([MS-ADTS] section 3.1.1.13.4).

      • Attributes has the A, B, C, and E bits set to 1, and all other bits set to zero.

  • Otherwise:

    • The SidCount field contains the number of groups in the ExtraSids field.

    • The ExtraSids field contains the pointer to a list which is the list copied from the PAC in the TGT plus a list constructed from the domain local groups (KERB_SID_AND_ATTRIBUTES [MS-PAC] section 2.2.1) where:

      • Sid contains the value from the ResourceSids parameter ([MS-ADTS] section 3.1.1.13.4).

      • Attributes has the A, B, C, and E bits set to 1, and all other bits set to zero.