Unlocking the black box that is AD RMS Part 5

All right folks, this will be the final scenario that we cover.

Scenario:This scenario will involve protecting a document and assigning Read rights to Group3@contoso.local, which is a distribution group in contoso.local containing as a member acontact object representing UserGG from fabrikam.local. The contact object will be populated with UserGG’s email address of UserGG@fabrikam.local.
Author: UserA@contoso.local
Consumer: UserGG@contoso.local
Captures:Scenario 4 Captures
Let’s begin…

  1. Client searches registry to see if service connection point (SCP) has been hardcoded. It checks the following keys:
    • HKLMSoftwareMicrosoftMSDRMServiceLocationActivation – This is a hardcoded location for client activation.
    • HKLMSoftwareMicrosoftMSDRMServiceLocationEnterprise – This is the hardcoded location to obtain a CLC.
    • HKCUSoftwareMicrosoftOffice14.0CommonDRMServiceLocation – This is where previously discovered service locations are stored for Office 2010.
    • HKCUSoftwareMicrosoftOffice15.0CommonDRMServiceLocation – This is where previously discovered service locations are stored for Office 2013.
  2. Client contacts contoso.local AD RMS cluster via the licensing pipeline (https://adrms.contoso.local/_wmcs/licensing) stored in the protected document and requests a EUL. Client is redirected to license.asmx and acquisition of EUL begins.
  3. AD RMS Server in contoso.local makes the following queries to the global catalog in contoso.local:
    1. Resolve the group membership for the UserGG contact object in the contoso.local domain.
      • Filter: (& (| (mail=UserGG@fabrikam.local)(proxyAddresses=smtp:UserGG@fabrikam.local))(|(objectcategory=computer)(objectcategory=person)))
        Attributes: ( mail )( objectSid )( sIDHistory )( proxyAddresses )( memberOf )( primaryGroupId )( distinguishedName )( uSNChanged )( msExchOriginatingForest )( msExchDynamicDLBaseDN )( msExchDynamicDLFilter )( userPrincipalName )( sAMAccountName )

      This search will return the contact object in the contoso.local domain that exists with the UserC@fabrikam.local email address.  This search also allows the AD RMS server to verify UserC isn’t AKA UserA@contoso.local.

    2. Check contoso.local to see if a user, computer, or contact object exists with the SID of the consumer (UserGG@fabrikam.local).
      • Filter: ( & ( | (objectSid=ConsumerSID) (sIDHistory=ConsumerSID) ) ( | (objectCategory=Computer) (objectCategory=Person) ) )
        Attributes: mail,objectSid,sIDHistory,proxyAddresses,memberOf,primaryGroupID,distinguishedName,uSNChanged,msExchOriginatingForest,msExchDynamicDLBaseDN, msExchDynamicDLFilter,userPrincipalName,sAMAccountName

      This search will return zero results as no such object exists.  This search also is being used to check whether or not the authenticated user is AKA Group3@contoso.local

    3. Check contoso.local to see if a user, computer, or contact object exists with the consumer’s email address (UserGG@fabrikam.local).
      • Filter: (& (| (mail=UserGG@fabrikam.local)(proxyAddresses=smtp:UserGG@fabrikam.local))(|(objectcategory=computer)(objectcategory=person)))
        Attributes: ( mail )( objectSid )( sIDHistory )( proxyAddresses )( memberOf )( primaryGroupId )( distinguishedName )( uSNChanged )( msExchOriginatingForest )( msExchDynamicDLBaseDN )( msExchDynamicDLFilter )( userPrincipalName )( sAMAccountName )

      This search will return the contact object in the contoso.local domain that exists with the UserGG@fabrikam.local email address. This contact object is used to represent UserGG from the fabrikam.local domain.  This search also is being used to check whether or not email address represented in the consumer’s RAC is linked to an object with the group2@contoso.local email address.

    4. Check contoso.local to see whether or not Group2@contoso.local is a valid group.
      • Filter: (& (| (mail=group3@contoso.local)(proxyAddresses=smtp:group3@contoso.local))(|(objectCategory=group)(objectCategory=msExchDynamicDistributionList)(&(objectCategory=contact)(msExchOriginatingForest Present))))
        Attributes: ( mail )( objectSid )( sIDHistory )( proxyAddresses )( memberOf )( primaryGroupId )( distinguishedName )( uSNChanged )( msExchOriginatingForest )( msExchDynamicDLBaseDN )( msExchDynamicDLFilter )( userPrincipalName )( sAMAccountName )

      This search will return Group3 distribution group object in the contoso.local domain.  This check is being used to determine if the Group3 is a valid group.

    5. Check contoso.local for consumer’s (UserGG@fabrikam.local) SID to see if a user, computer, or contact object exists in the contoso.local domain with the MemberOf attribute populated with group3@contoso.local’s SID.
      • Filter: ( & ( | (objectSid=ConsumerSID9) (sIDHistory=ConsumerSID) ) ( | (objectCategory=Computer) (objectCategory=Person) ) )
        Attributes: mail,objectSid,sIDHistory,proxyAddresses,memberOf,primaryGroupID,distinguishedName,uSNChanged,msExchOriginatingForest,msExchDynamicDLBaseDN, msExchDynamicDLFilter,userPrincipalName,sAMAccountName

      This search will return zero results as no such object exists.  This check is being used to determine if the authenticated user is a valid user in the contoso.local forest, which it is not.

    6. Check contoso.local for any group or contact object with msExchOriginatingForest (think group expansion here) that is a member of Group2.
      • Filter: (|(&(objectCategory=group)(memberOf=<GUID=<GroupGUID>))(&(objectCategory=contact)(memberOf=<GroupGUID>)(msExchOriginatingForest Present)))
        Attributes: ( mail )( distinguishedName )( msExchOriginatingForest )

      This search will return zero results as no such object exists.  This check is being used to determine whether the authenticated user is a member of the group.

    7. Resolve the group membership of the Group3 group object in contoso.local.
        • Filter: (& (| (mail=group3@contoso.local)(proxyAddresses=smtp:group3@contoso.local))(|(objectCategory=group)(objectCategory=msExchDynamicDistributionList)(&(objectCategory=contact)(msExchOriginatingForest Present))))
          Attributes: ( mail )( objectSid )( sIDHistory )( proxyAddresses )( memberOf )( primaryGroupId )( distinguishedName )( uSNChanged )( msExchOriginatingForest )( msExchDynamicDLBaseDN )( msExchDynamicDLFilter )( userPrincipalName )( sAMAccountName )

      This search will return Group3 distribution group object in the contoso.local domain.  This check is again used to determine if Group2 is a valid group.

    8. Resolve the group membership for the UserGG contact object in the contoso.local domain.
      • Filter: (& (| (mail=UserGG@fabrikam.local)(proxyAddresses=smtp:UserGG@fabrikam.local))(|(objectcategory=computer)(objectcategory=person)))
        Attributes: ( mail )( objectSid )( sIDHistory )( proxyAddresses )( memberOf )( primaryGroupId )( distinguishedName )( uSNChanged )( msExchOriginatingForest )( msExchDynamicDLBaseDN )( msExchDynamicDLFilter )( userPrincipalName )( sAMAccountName )

      This search will return the contact object in the contoso.local domain that exists with the UserGG@fabrikam.local email address.  This verified that the contact object representing UserGG is a member of Group3.

    9. Check contoso.local to see if a user, computer, or contact object exists with the SID of the consumer (UserGG@fabrikam.local).
      • Filter: ( & ( | (objectSid=ConsumerSID) (sIDHistory=ConsumerSID) ) ( | (objectCategory=Computer) (objectCategory=Person) ) )
        Attributes: mail,objectSid,sIDHistory,proxyAddresses,memberOf,primaryGroupID,distinguishedName,uSNChanged,msExchOriginatingForest,msExchDynamicDLBaseDN, msExchDynamicDLFilter,userPrincipalName,sAMAccountName

      This search will return zero results as no such object exists.  This check is is being used to verify whether or or not the authenticated user is AKA the publisher (userA@contoso.local).

    10. Resolve the group membership for the UserGG contact object in the contoso.local domain.
      • Filter: (& (| (mail=UserGG@fabrikam.local)(proxyAddresses=smtp:UserGG@fabrikam.local))(|(objectcategory=computer)(objectcategory=person)))
        Attributes: ( mail )( objectSid )( sIDHistory )( proxyAddresses )( memberOf )( primaryGroupId )( distinguishedName )( uSNChanged )( msExchOriginatingForest )( msExchDynamicDLBaseDN )( msExchDynamicDLFilter )( userPrincipalName )( sAMAccountName )

      This search will return the contact object in the contoso.local domain that exists with the UserGG@fabrikam.local email address.  This check is being used to verify whether or not the contact object representing UserGG is AKA as the publisher (userA@contoso.local).

    11. Check to see whether the publisher (UserA@fabrikam.local) is a valid group.
      • Filter: (& (| (mail=UserA@contoso.local)(proxyAddresses=smtp:UserA@contoso.local))(|(objectcategory=group)(objectcategory=msExchDynamicDistributionList)(&(objectCategory=contact)(msExchOriginatingForest Present))))
        Attributes: ( mail )( objectSid )( sIDHistory )( proxyAddresses )( memberOf )( primaryGroupId )( distinguishedName )( uSNChanged )( msExchOriginatingForest )( msExchDynamicDLBaseDN )( msExchDynamicDLFilter )( userPrincipalName )( sAMAccountName )

      This search will return zero results as UserA is not a group or contact object with msExchOriginatingForest populated.

    12. Run the same query again for some reason.
      • Filter: (& (| (mail=UserA@fabrikam.local)(proxyAddresses=smtp:UserA@fabrikam.local))(|(objectcategory=group)(objectcategory=msExchDynamicDistributionList)(&(objectCategory=contact)(msExchOriginatingForest Present))))
        Attributes: ( mail )( objectSid )( sIDHistory )( proxyAddresses )( memberOf )( primaryGroupId )( distinguishedName )( uSNChanged )( msExchOriginatingForest )( msExchDynamicDLBaseDN )( msExchDynamicDLFilter )( userPrincipalName )( sAMAccountName )

      This search will return zero results as UserA is not a group or contact object with msExchOriginatingForest populated.

  4. After confirming group membership with the 9th LDAP query listed in the previous step, AD RMS Server in contoso.local issues EUL and sends back to client in fabrikam.local.
  5. Client receives EUL, consumes it, and contents are displayed in Microsoft Office application with appropriate rights applied.

I found a few articles from Microsoft stating that msDS-SourceObjectDN was required when doing group membership in this manner. The articles were specific to Microsoft Exchange IRM, so it is possible additional queries are performed when Microsoft Exchange is involved. For the purposes above, the attribute was not required for consumption.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s