Package com.microsoft.jenkins.azuread

Class ObjId2FullSidMap

java.lang.Object

java.util.AbstractMap<String,String>

java.util.HashMap<String,String>

com.microsoft.jenkins.azuread.ObjId2FullSidMap

All Implemented Interfaces:

Serializable, Cloneable, Map<String,String>

public class ObjId2FullSidMap
extends HashMap<String,String>

See Also:

• Serialized Form

Nested Class Summary

Nested classes/interfaces inherited from class java.util.AbstractMap

AbstractMap.SimpleEntry<K,V>, AbstractMap.SimpleImmutableEntry<K,V>

Nested classes/interfaces inherited from interface java.util.Map

Map.Entry<K,V>

Field Summary

Fields

Modifier and Type	Field	Description
static final String	ENABLE_DISPLAY_NAME_AUTHORIZATION_PROPERTY	Escape hatch to restore the legacy behaviour of authorizing groups by their Entra display name.

Constructor Summary

Constructors

Constructor	Description
ObjId2FullSidMap()

Method Summary

Modifier and Type	Method	Description
String	getOrOriginal(String objectId)
static boolean	isDisplayNameAuthorizationEnabled()	Whether the insecure legacy display-name authorization behaviour is enabled via ENABLE_DISPLAY_NAME_AUTHORIZATION_PROPERTY.
void	putFullSid(String fullSid)

Methods inherited from class java.util.HashMap

clear, clone, compute, computeIfAbsent, computeIfPresent, containsKey, containsValue, entrySet, forEach, get, getOrDefault, isEmpty, keySet, merge, newHashMap, put, putAll, putIfAbsent, remove, remove, replace, replace, replaceAll, size, values

Methods inherited from class java.util.AbstractMap

equals, hashCode, toString

Methods inherited from class java.lang.Object

finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface java.util.Map

equals, hashCode

Field Details

ENABLE_DISPLAY_NAME_AUTHORIZATION_PROPERTY

public static final String ENABLE_DISPLAY_NAME_AUTHORIZATION_PROPERTY

Escape hatch to restore the legacy behaviour of authorizing groups by their Entra display name. Disabled by default (SECURITY-3935): Entra group display names are neither unique nor immutable and, unless the tenant restricts it, any member can create a group with an arbitrary display name. Matching a bare display name against a grant therefore lets an attacker inherit a privileged group's permissions by creating a colliding group. Set this system property to true at startup only as a temporary measure while migrating existing grants to object IDs.

Constructor Details

ObjId2FullSidMap

public ObjId2FullSidMap()

Method Details

isDisplayNameAuthorizationEnabled

public static boolean isDisplayNameAuthorizationEnabled()

Whether the insecure legacy display-name authorization behaviour is enabled via ENABLE_DISPLAY_NAME_AUTHORIZATION_PROPERTY. Defaults to false.

putFullSid

public void putFullSid(String fullSid)

getOrOriginal

public String getOrOriginal(String objectId)