php - 用于验证 Active Directory 对象 SID 的正则表达式

Question

我正在寻找一种方法来验证从 Active Directory 插入的对象 SID 是否有效，是否可以使用 preg_match() 或 preg_match_all()？我在网上寻找用于此验证的正则表达式，但找不到任何东西。

例子:

$sid = 'S-1-5-21-1220945662-1202665555-839525555-5555';

if ($validator->validateSid($sid)) {
    // SID is valid!
}

我不擅长编写正则表达式，所以如果有人有任何意见，请告诉我，谢谢!

编辑:对于任何使用以下正则表达式寻找代码的人:

preg_match("/^S-1-[0-5]-\d{2}-\d{10}-\d{10}-\d{9}-[1-9]\d{3}/", $search, $matches);

// Returns
array(
    0 => S-1-5-21-1220945662-1202665555-839525555-5555
)

或者更宽松的模式:

preg_match("/S-1-5-21-\d+-\d+\-\d+\-\d+/", $sid, $matches);

// Returns
array(
    0 => S-1-5-21-1220945662-1202665555-839525555-5555
)

Answer 1

hjpotter92 的回答适用于某些 SID，但并非全部。每个子权限由一个 32 位整数组成，可以是 10 位或 8 位，具体视情况而定。您应该将正则表达式编辑为:

/^S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3}/

Whenever a new issuing authority under Windows is created (for example, a new machine deployed or a domain created), it is assigned a SID with 5 (an arbitrary value) as the identifier authority; a fixed value of 21 is used as a unique value to root this set of subauthorities, and a 96-bit random number is created and parceled out to the three subauthorities with each subauthority that receives a 32-bit chunk.

https://msdn.microsoft.com/en-us/library/cc246018.aspx

How SIDs are created

https://en.wikipedia.org/wiki/Security_Identifier