6.11Security descriptors, delegations and managed service accounts
Last updated
SYNERGY Management Gateway can read and change an object's access control list, apply named delegations, manage service principal names, and manage managed and group managed service accounts. These capabilities are not offered in the console. They are available through the REST API (and, in part, to AI agents and n8n), always behind their own permissions. The one exception in the browser is the OU's protection from accidental deletion (see 6.8).
| Capability | REST route (under /api) | Permission |
|---|---|---|
| Read an object's access control list | GET /ad/objects/{id}/acl | ad:acl:read |
| Add or remove access control entries, change owner or inheritance | /ad/objects/{id}/acl/aces, /acl/owner, /acl/inheritance | ad:acl:manage |
| List delegation templates, read and apply named delegations | /ad/delegation-templates, /ad/objects/{id}/delegations | ad:acl:read (read), ad:acl:delegate (apply) |
| Read and write service principal names | /ad/users/{id}/spns, /ad/computers/{id}/spns | ad:spn:manage |
| Managed service accounts | /ad/service-accounts and related routes | ad:serviceaccounts:list, read, create, update, delete |
The named delegations available are:
| Delegation key | Grants |
|---|---|
reset-user-passwords | Reset user passwords and force a password change at next logon. |
create-delete-users | Create, delete and manage user accounts. |
join-computers-to-domain | Join a computer to the domain (create computer objects only). |
manage-group-membership | Modify the membership of groups. |
read-all-properties | Read all properties. |
full-control | Full control. |
Important: Rewriting an access control list, applying a delegation, writing service principal names and managing service accounts can each hand out privilege. Their permissions are deliberately separate from the ordinary directory permissions, so a role that edits users does not pick them up. No route returns a managed service account's password at any permission level.
See Chapter 15, REST API for integrators, Chapter 13, AI agents (MCP server), and Chapter 14, n8n integration.
Last updated
Thank you for your feedback.