- Add support for LAPS v2

- Some code refactor / cleanup
- new color scheme
- update packages

README.md

@@ -4,7 +4,7 @@ A nice and simple Web Interface for LAPS (Local Administrator Password Solution)
 ## Setup Preqesites
 
 - A working Active Directory with Microsoft LAPS installed
-- .NET Core 6.0 compatible Operating System (Ubuntu/Debian/CentOS/Alpine Linux/Windows/macOS) or a Docker Host
+- .NET Core 7.0 compatible Operating System (Ubuntu/Debian/CentOS/Alpine Linux/Windows/macOS) or a Docker Host
 
 ## Setup (bare metal):
 
@@ -13,6 +13,18 @@ A nice and simple Web Interface for LAPS (Local Administrator Password Solution)
 - Adjust appsettings.json or set the settings via Environment Variables
 - Run *LAPS-WebUI*
 
+## Notes for LAPS v2
+- Since Version 1.5.0 LAPS v2 is supported
+- By default, LAPS v2 passwords are encrypted. If the LAPS v2 passwords are stored unencrypted, then you have to set
+ `EncryptionDisabled` to `true` in the settings
+- When LAPS v2 Passwords are encrypted a direct connection to the domain controllers with `Kerberos` and `DCE-RPC` is needed in order to decrypt those passwords. For LAPS v1 and unecrypted LAPS v2 passwords only `LDAP` is needed
+### New LAPS Settings
+```
+ "LAPS": {
+ "ForceVersion": null, # Allowed Values: v1, v2 | Default: null (both versions)
+ "EncryptionDisabled": false # Allowed Values: true, false | Default: false
+ }
+```
 ## Setup (docker):
 
 Running LAPS-WebUI in docker is quite easy:

src/.editorconfig

@@ -0,0 +1,4 @@
+[*.cs]
+
+# S112: General exceptions should never be thrown
+dotnet_diagnostic.S112.severity = none

src/Components/LapsInformationDetail.razor

@@ -0,0 +1,16 @@
+@inherits MudComponentBase
+@if (LapsInfo != null)
+{
+ <MudStack Spacing="2">
+ <MudField Label="Password" Variant="Variant.Text" Adornment="Adornment.Start" AdornmentIcon="@Icons.Material.Outlined.Password" AdornmentColor="Color.Default" aria-label="LAPS Password">@LapsInfo.Password</MudField>
+ @if (LapsInfo.Account != null)
+ {
+ <MudField Label="Account" Variant="Variant.Text" Adornment="Adornment.Start" AdornmentIcon="@Icons.Material.Outlined.AccountCircle" AdornmentColor="Color.Default" aria-label="LAPS Managed Account">@LapsInfo.Account</MudField>
+ }
+ @if (LapsInfo.PasswordSetDate != null)
+ {
+ <MudField Label="Set Date" Variant="Variant.Text" Adornment="Adornment.Start" AdornmentIcon="@Icons.Material.Outlined.MoreTime" AdornmentColor="Color.Default" aria-label="LAPS Password Set Date">@LapsInfo.PasswordSetDate</MudField>
+ }
+ <MudField Label="Expire Date" Variant="Variant.Text" Adornment="Adornment.Start" AdornmentIcon="@Icons.Material.Outlined.HourglassBottom" AdornmentColor="Color.Default" aria-label="LAPS Password Expire Date">@LapsInfo.PasswordExpireDate</MudField>
+ </MudStack>
+}

src/Components/LapsInformationDetail.razor.cs

@@ -0,0 +1,11 @@
+using LAPS_WebUI.Models;
+using Microsoft.AspNetCore.Components;
+using MudBlazor;
+
+namespace LAPS_WebUI.Components
+{
+ public partial class LapsInformationDetail : MudComponentBase
+ {
+ [Parameter] public LapsInformation? LapsInfo { get; set; }
+ }
+}

src/Dockerfile

@@ -20,10 +20,11 @@ FROM base AS final
 WORKDIR /app
 RUN apt update && \
  apt upgrade -y && \
- apt install --no-install-recommends -y ca-certificates libldap-2.4-2 && \
+ apt install --no-install-recommends -y ca-certificates libldap-2.4-2 gcc python3 python3-dev python3-pip libkrb5-dev && \
  apt clean && \
  rm -rf /var/lib/apt/lists/* && \
  ln -s /usr/lib/x86_64-linux-gnu/libldap-2.4.so.2 /usr/lib/libldap.so.2 && \
- ln -s /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 /usr/lib/liblber.so.2
+ ln -s /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 /usr/lib/liblber.so.2 && \
+ pip3 install dpapi-ng[kerberos]
 COPY --from=publish /app/publish .
-ENTRYPOINT ["dotnet", "LAPS-WebUI.dll"]
+ENTRYPOINT ["dotnet", "LAPS-WebUI.dll"]

src/Enums/LAPSVersion.cs

@@ -0,0 +1,10 @@
+using System.Runtime.Intrinsics;
+
+namespace LAPS_WebUI.Enums
+{
+ public enum LAPSVersion
+ {
+ v1,
+ v2
+ }
+}

src/Interfaces/ILDAPService.cs

@@ -3,7 +3,7 @@
 
 namespace LAPS_WebUI.Interfaces
 {
- public interface ILDAPService
+ public interface ILdapService
  {
  Task<LdapConnection?> CreateBindAsync(string username, string password);
  Task<bool> TestCredentialsAsync(string username, string password);

src/LAPS-WebUI.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
+<Project Sdk="Microsoft.NET.Sdk.Web">
 
  <PropertyGroup>
  <TargetFramework>net7.0</TargetFramework>
@@ -12,15 +12,23 @@
 
  <ItemGroup>
  <PackageReference Include="Blazored.SessionStorage" Version="2.3.0" />
+ <PackageReference Include="CliWrap" Version="3.6.4" />
  <PackageReference Include="CurrieTechnologies.Razor.Clipboard" Version="1.6.0" />
  <PackageReference Include="LdapForNet" Version="2.7.15" />
- <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="7.0.4" />
+ <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="7.0.8" />
  <PackageReference Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.18.1" />
  <PackageReference Include="Microsoft.Web.LibraryManager.Build" Version="2.1.175" />
- <PackageReference Include="MudBlazor" Version="6.2.0" />
- <PackageReference Include="Serilog" Version="2.12.0" />
- <PackageReference Include="Serilog.AspNetCore" Version="6.1.0" />
+ <PackageReference Include="MudBlazor" Version="6.6.0" />
+ <PackageReference Include="Serilog" Version="3.0.1" />
+ <PackageReference Include="Serilog.AspNetCore" Version="7.0.0" />
  <PackageReference Include="Serilog.Sinks.Console" Version="4.1.0" />
+ <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="7.0.1" />
+ </ItemGroup>
+
+ <ItemGroup>
+ <None Update="scripts\DecryptEncryptedLAPSPassword.py">
+ <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+ </None>
  </ItemGroup>
 
 </Project>

src/LAPS-WebUI.sln

@@ -5,6 +5,11 @@ VisualStudioVersion = 17.2.32519.379
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "LAPS-WebUI", "LAPS-WebUI.csproj", "{7B7F4DF1-306F-4A4A-B074-7CF2D731F39A}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{A62D500C-9708-45CC-A92F-E9D61AB47264}"
+ ProjectSection(SolutionItems) = preProject
+ .editorconfig = .editorconfig
+ EndProjectSection
+EndProject
 Global
  GlobalSection(SolutionConfigurationPlatforms) = preSolution
  Debug|Any CPU = Debug|Any CPU

src/Models/ADComputer.cs

@@ -5,12 +5,24 @@ public class ADComputer
  public ADComputer(string name)
  {
  this.Name = name;
- this.LAPSPassword = String.Empty;
- this.LAPSPasswordExpireDate = DateTime.MinValue;
  }
 
  public string Name { get; set; }
- public string LAPSPassword { get; set; }
- public DateTime LAPSPasswordExpireDate { get; set; }
+ public List<LapsInformation>? LAPSInformations { get; set; }
+
+ public bool Loading
+ {
+ get
+ {
+ if (LAPSInformations is null || !LAPSInformations.Any())
+ {
+ return true;
+ }
+ else
+ {
+ return false;
+ }
+ }
+ }
  }
 }

src/Models/LDAPOptions.cs

@@ -1,6 +1,6 @@
 namespace LAPS_WebUI.Models
 {
- public class LDAPOptions
+ public class LdapOptions
  {
  public string? Server { get; set; }
  public int Port { get; set; }

src/Models/LapsInformation.cs

@@ -0,0 +1,14 @@
+using LAPS_WebUI.Enums;
+
+namespace LAPS_WebUI.Models
+{
+ public class LapsInformation
+ {
+ public string? Password { get; set; }
+ public string? Account { get; set; }
+ public DateTime? PasswordExpireDate { get; set; }
+ public DateTime? PasswordSetDate { get; set; }
+ public LAPSVersion? Version { get; set; }
+ public bool IsCurrent { get; set; }
+ }
+}

src/Models/LapsOptions.cs

@@ -0,0 +1,10 @@
+using LAPS_WebUI.Enums;
+
+namespace LAPS_WebUI.Models
+{
+ public class LapsOptions
+ {
+ public LAPSVersion? ForceVersion { get; set; }
+ public bool EncryptionDisabled { get; set; }
+ }
+}

src/Models/msLAPSPayload.cs

@@ -0,0 +1,16 @@
+using System.Text.Json.Serialization;
+
+namespace LAPS_WebUI.Models
+{
+ public class MsLAPSPayload
+ {
+ [JsonPropertyName("n")]
+ public string? ManagedAccountName { get; set; }
+
+ [JsonPropertyName("t")]
+ public string? PasswordUpdateTime { get; set; }
+
+ [JsonPropertyName("p")]
+ public string? Password { get; set; }
+ }
+}

src/Pages/Index.razor

@@ -1,19 +1,3 @@
 @page "/"
 @inject ISessionManagerService sessionManager
-@inject NavigationManager NavigationManager
-@code{
-
- protected override async Task OnAfterRenderAsync(bool firstRender)
- {
- // redirect to home if already logged in
- if (await sessionManager.IsUserLoggedInAsync())
- {
- NavigationManager.NavigateTo("/laps");
- }
- else
- {
- NavigationManager.NavigateTo("/login");
- }
- }
-
-}
+@inject NavigationManager NavigationManager

src/Pages/Index.razor.cs

@@ -0,0 +1,18 @@
+namespace LAPS_WebUI.Pages
+{
+ public partial class Index
+ {
+ protected override async Task OnAfterRenderAsync(bool firstRender)
+ {
+ // redirect to home if already logged in
+ if (await sessionManager.IsUserLoggedInAsync())
+ {
+ NavigationManager.NavigateTo("/laps");
+ }
+ else
+ {
+ NavigationManager.NavigateTo("/login");
+ }
+ }
+ }
+}