Find if a given SID belongs to a group identified by SID - winapi

Question

I'm writing a windows service that performs operations according to different rules, one of which is based on the requesting user identity.
It thus receives the requesting user SID and then compares it to its internal list of SIDs to decide what operation it will perform. Using the EqualSID API function makes this very easy.
However, I am now faced with the situation where some SIDs in the service list are group SIDs and not user SIDs.
This means that I have to find a way to test if the received SID is either equal to the one in the list or belongs to the group that is represented by the SID in the list.
I looked around to see what APIs would be available and found about CheckTokenMembership which requires a token handle. That's where I'm a bit lost because as the service is not necessarily located on the same machine, I can't seem to find a way to create a valid token handle from the SID that I have received.
The service itself runs under the default "NT Service" account and I would prefer if it could stay this way.
What API would you suggest I use?
The target language is Delphi but I can understand examples in plain C.

Answer 1

Well, after looking around at various other things I finally managed to find a way to achieve this. In short, the answer is Active Directory Service Interfaces also known as ADSI
To give a bit more details should someone else be looking at that, here is a series of steps to achieve this in Delphi:
Import the Active DS Type Library set of objects into Delphi. This will create the ActiveDs_TLB unit with all the necessary interfaces
Declare AdsGetObject like so
function ADsGetObject(lpszPathName: WideString; const riid: TGUID; out ppObject): HRESULT; safecall;
Retrieve an IADSUser instance with the SID syntax:
var
SIDUser: IADSUser;
User: IADSUser;
SIDGroup: IADSGroup;
Group: IADSGroup;
begin
// Bind using the SID
AdsGetObject('LDAP://<SID=S-1-5-7>', IADSUser, SIDUser);
// rebind using the distinguished name as suggested by MSDN
AdsGetObject('LDAP://' + SIDUser.Get('distinguishedName'), IADSUser, User);
// Use the User instance
ShowMessage(User.FullName);
// Same method for group
AdsGetObject('LDAP://<SID=S-1-5-32-545>', IADSGroup, SIDGroup);
AdsGetObject('LDAP://' + SIDGroup.Get('distinguishedName'), IADSGroup, Group);
// IsMember does not seem to work with LDAP
// https://groups.google.com/forum/#!topic/microsoft.public.adsi.general/2d-e4HPXGfA
// http://www.rlmueller.net/Programs/IsMember4.txt
// if Group.IsMember(User.ADsPath) then
if AdsIsMember(User, 'S-1-5-32-545') then
ShowMessage('InGroup');
end;
As you can see, one would want to use the IsMember method of IADSGroup but clearly it does not work because it should return True in the above case (S-1-5-32-545 is the world group).
So as suggested by the link give in the comment, I wrote my own IsMember like so:
function ADsIsMember(const User: IADSUser; const GroupSID: string): Boolean;
const
TokenGroupsId = 'tokenGroups';
var
PropNames: array of OleVariant;
TokenGroups: OleVariant;
TokenGroupLow: Integer;
TokenGroupHigh: Integer;
TokenGroupIndex: Integer;
SIDBytes: array of Byte;
SIDAsString: PChar;
begin
Result := False;
SetLength(PropNames, 1);
PropNames[0] := TokenGroupsId;
User.GetInfoEx(PropNames, 0);
TokenGroups := User.Get(TokenGroupsId);
TokenGroupLow := VarArrayLowBound(TokenGroups, 1);
TokenGroupHigh := VarArrayHighBound(TokenGroups, 1);
for TokenGroupIndex := TokenGroupLow to TokenGroupHigh do
begin
SIDBytes := TokenGroups[TokenGroupIndex];
ConvertSidToStringSid(#SIDBytes[0], SIDAsString);
if GroupSID = SIDAsString then
Exit(True);
end;
end;
With all this, I can now check if a given SID belongs to a group defined by its SID.