Delegation Via Attributes

DRAFT

Overview

Delegation Via Attributes (DVA) will allow departments to request and remove delegations on Active Directory objects. This process is composed of the following parts: the delegation request, the requests attribute, the delegation processing, and the results attribute. The delegation request is a JSON string that contains the required properties and values for the delegation. The JSON string is written to the requests attribute on a deparment's Administrative OU. The delegation processing is comprised of a PowerShell script and the scheduled tasks that run the PowerShell script every hour. The PowerShell script will remove the original JSON string from the requests attributes and write the output from delegation processing as a JSON string to the results attribute on the department's Administrative OU.

Attributes

The attributes used by Delegation Via Attributes are stored on a departemnt's Administrative OU object. For example: "OU=TEST,OU=Departments,OU=Administrative,DC=austin,DC=utexas,DC=edu" would be the Administrative OU for the TEST department.

The requests attribute is the utexasEduAustinMulti1 attribute on a department's Administrative OU. Department Owners can read and write to this attribute to submit a delegation request.
The results attribute is the utexasEduAustinMulti2 attribute on a department's Administrative OU. Department Owners can read this attribute to review the results of delegation processing.

Delegation Request

Each delegation request is a JSON string that contains the following properties and values:

Property	Value	Notes
Timestamp	When to process the request	Must be a valid time value. Can be set for a future time to scheduled the request.
RequestedBy	Required - EID submitting the request	Must EID for reporting and validating against the Department's Owners group.
RequestedFor	Optional - EID requesting the delegation	May EID for original user who requested the delegation from the owner
Action	Action for the request	Must be one of the following approved verbs: Add, Remove, Repalce, Clear
Principal	AD group in the delegation	Must be an Active Directory security group. Delegation to individual users is not permitted
Path	OU targetted by the request	Must be an OU under the Department's OU.
Delegation	Permissions for request	Must be one of the standard delegations: <link to delegations page>

Delegation Results

Each delegation result is a JSON string that contains the following properties and values:

Property	Value	Notes
Timestamp	When the request was processed	The time when the script processed the request.
Request	The original delegation request	The original JSON string from the request attribute
Success	True or False	True if the request was processed successfully. False otherwise.
Error	Present when Success is False	Contains the reason the request could not be processed as submitted.

Pseudo-code

Query for <object-class> in <container> where:
1. <action-attribute> is true
2. <permission-attribute> has a value
3. <targets-attribute> has a value
For each object found in previous step...
1. Grant <permission-attribute> delegation on object to each principal in <targets-attribute>
2. Update <reports-attribute> with "<timestamp>;<add/remove>;<delegation>;<DNs>"
3. Clear <action-attribute>, <permission-attribute>, <targets-attribute>
Create scheduled task on ADFS servers to perform query every hour
1. Run as dedicated GMSA
  1. All permissions actions taken by known account
  2. Password of account managed by domain
2. Leverage HostCheck
  1. Avoid duplication of work

Expansion options

Set <action-attribute> to false to remove a delegation
Allow <permission-attribute> to be SDDL
- SDDL must be checked for prohibited permissions
Add Reset as a delegation to reset permissions on an OU
- Ensure that <DEPT>-Permissions are restored after a reset on a department root.