Repository navigation
Match the signed-in account by SID so Entra ID sign-ins run the login payloads - #35
Merged
Merged
Conversation
… payloads The login gate compared the 4624 TargetUserName with the session's user name. For an Entra ID sign-in the event names the account by its UPN while the session reports the short name, so every Entra sign-in was rejected as another account logging on inside the session, and login-every and login-privileged-every never ran. The worker now reads TargetUserSid from the event and the session user's SID from its token, and the gate compares SIDs when both are present. The name comparison remains as a fallback and now strips both the domain prefix and the UPN suffix. The once-per-sign-in key uses the session SID when it is known.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #34
Problem
LoginGate.Claimcompared the 4624TargetUserNamewith the WTS session user name. Entra ID sign-ins give the UPN in the event and the short name in the session, so the gate decided another account had logged on inside the session and skipped login-every and login-privileged-every. Local accounts match by name, which is why it went unnoticed.Change
LogonEventWorkerreadsTargetUserSid(property 4) and passes it to the gate.ShellReadiness.GetSessionUserSid:WTSQueryUserToken→ token user SID (needs SYSTEM; returns null elsewhere).LoginGate.Claimcompares SIDs when both are present; otherwise falls back to names with theDOMAIN\/AzureAD\prefix and@domainsuffix removed.Tests
dotnet test: 391 passed, 0 failed. New cases: UPN event vs short session name with matching SID passes; different SID rejects (runas / elevation still caught); missing SID falls back to normalized names; catch-up plus event dedupes.Not verified live
No end-to-end run with the installed service and a fresh Entra sign-in yet.
Risk: medium — changes the login gate in the SYSTEM service on every endpoint; revert undoes it.