4 Commits (3fb55cba60c306255eea06b15145ad0c43d4e4cc)

Author	SHA1	Message	Date
Selva Nair	c3e4247e30	Close token handle in GetProcessTokenGroups() ... Signed-off-by: Selva Nair <selva.nair@gmail.com>	8 years ago
Selva Nair	921a4ed535	Check group membership without needing connection to DC ... Current approach of querying the group membership of DOMAIN\username fails for domain users if no DC is reachable. Instead authorize the user if (i) admin groups are found in the process token (ii) or the SID of the user is a member of the admin groups The second check is needed to support adding the user to the ovpn_admin_group when GUI is running, as such changes in group membership will not be reflected in the token. Signed-off-by: Selva Nair <selva.nair@gmail.com>	8 years ago
Selva Nair	6d9ab8122c	Ensure group name in shell-execute cmdline is clean ... - Also fix typo in a comment. Signed-off-by: Selva Nair <selva.nair@gmail.com>	9 years ago
Selva Nair	43d0ef3a5a	Handle interactive service policy restrictions ... When a connection is attempted using a config in a location that would fail, offer an option to add the user to the "OpenVPN Administrators" group. This is done using shell-execute which will show a UAC prompt for elevation. If it fails (due to user chooses NO or the UAC dialog fails) the connection is not started. v2 Changes - Rebase to master - Automaticlaly add the admin group if it doesn't exist - Allow unicode strings in debug output - Use domain\username to identify user - Fix the PrintDebug macro Minor changes based on user feedback - Bring the window back to foreground after UAC prompt completion - Show a message if another connection is tried during authorization - Do not add user to ovpn_admin_group if it is same as the built-in admin group Signed-off-by: Selva Nair <selva.nair@gmail.com>	9 years ago