Access Control Lab: ACL evaluation
Examine token snapshots, requested rights and ordered DACL ACE evaluation in a bounded teaching model.
Find why a requested right is granted or denied.
- Select a token, requested right and DACL example.
- Advance the steps and follow the order in which ACEs are examined.
- Change one condition and compare the result and its reason.
Explain how different requested rights can produce different decisions for the same user.
The mechanism explained by this model
The model is a synthetic teaching example. It does not execute Windows API calls or real cryptography. Interactive controls require JavaScript; the mechanism is also explained in the linked lessons.
The difference between authentication and authorization: Why proving your identity is not permission to access
This lesson establishes the boundary between authentication and authorization: authentication proves identity and generates an access token; authorization compares that token with the DACL of a specific object for a specific requested right. How the groups are collected for the token is at 05.01; reading of security descriptor/DACL/ACE at 05.03; Sequential evaluation of allow/deny/inheritance is covered in 05.04. The focus here is why the difference between 'I have proven my identity' and 'I am authorized to perform this action' is separate at the mechanism level.
Logon session and access token: How are a process’s identity and permissions formed?
After successful authentication, the authentication package creates a logon session in LSA and supplies information used to create a token. Every process has a primary token; a thread impersonating a client may also use an impersonation token. This lesson examines how access control selects an existing security context, not how directory membership changes.