EqualPrefixSid
The EqualPrefixSid
function tests two security-identifier (SID) prefix values for equality. A SID
prefix is the entire SID except for the last subauthority value.
BOOL EqualPrefixSid(
|
PSID pSid1, |
// pointer to first
SID to compare |
|
PSID pSid2 |
// pointer to
second SID to compare |
|
); |
|
Parameters
pSid1
Points to the
first SID
structure to compare. This structure is assumed to be valid.
pSid2
Points to the
second SID structure to compare. It also is assumed to be valid.
Return Values
If the SID
prefixes are equal, the return value is nonzero.
If the SID
prefixes are not equal, the return value is zero. To get extended error
information, call GetLastError.
Remarks
The EqualPrefixSid
function enables a server application in one domain to verify an attempt by a
user to log on to another domain. For example, if a user attempts to log on to
RemoteDomain from a workstation in LocalDomain, the server for LocalDomain can
request the SIDs for the user and the user s
groups from RemoteDomain. The domain controller for RemoteDomain responds with
the relevant SIDs.
All SIDs for
a specified domain necessarily have the same prefix. When the server receives
the user s SIDs, it can call the EqualPrefixSid function
for each SID, comparing the user or group SID against the SID for RemoteDomain.
If any of the SID prefixes are not equal, the server refuses the logon attempt.
It is
advisable to modify the SID for a domain before comparing it with a group or
user SID. If the SID for RemoteDomain is S-1-1234-8, each group or user SID for
that domain will have S-1-1234-8 as its prefix. To compare the SIDs by using the EqualPrefixSid
function, an application copies the domain SID and adds any subauthority (RID)
value to the copy, thereby creating a SID in the form S-1-1234-8-0. The application then uses the modified domain SID
as a template against which the group and user SIDs are compared.
See Also