🚀 go-pugleaf

Andrue Cope wrote:

>I think I've tried it with and without.

First thing I've noticed is that as soon as you hit

        while(pAttribute != NULL)

All returns leave the Connection Bound, and values allocated.

	TOKEN_READ|TOKEN_QUERY,

Note that TOKEN_READ includes TOKEN_QUERY

You call it  clientToken, but it is a process token (TRUE == process)

	if(!ConvertSidToStringSidW(ownerInfo->Owner, &ourSid))
	{
		delete[] ourSid;

Doesn't look right, should be LocalFree, or better yet, nothing
Also, you never use it nor  LocalFree( ourSid )   it.

The links I gave last night mention (among other things)

      // AccessCheck is sensitive about what is in the SD; set
      // the group and owner.
      SetSecurityDescriptorGroup(psdAdmin, psidAdmin, FALSE);
      SetSecurityDescriptorOwner(psdAdmin, psidAdmin, FALSE);

      dwAccessDesired = FM_ACCESS_READ;
      // Initialize GenericMapping structure even though we
      // won't be using generic rights.
      GenericMapping.GenericRead    = FM_ACCESS_READ;
      GenericMapping.GenericWrite   = FM_ACCESS_WRITE;
      GenericMapping.GenericExecute = 0;
      GenericMapping.GenericAll     = FM_ACCESS_READ |
FM_ACCESS_WRITE;

      if (!AccessCheck(psdAdmin, hToken, dwAccessDesired,
  
>If you want to play around with it (and I suppose it has educational
>value concerning LDAP <g>) I've uploaded a BCB6 project
>'AccessCheck.zip'. You'll need to change main() to use your login and
>domain details and you'll need to be running MS Exchange though unless
>you want to try for some other permission.

I don't think I have login and domain details, nor MS Exchange
(XPHome). No idea what to change to be meaningfull on my system.