Conversion Between MAPI and Windows Permissions

As described in "ACE Sequences in the ACL" in Details of the Exchange Access Control Process, Exchange routinely converts Windows 2000 permissions to and from MAPI permissions. This section lists the MAPI permissions that Exchange 2003 uses and demonstrates how Exchange converts permissions from one form to the other.

Available MAPI Permissions

The table in this section list the MAPI permissions that Exchange 2003 uses. Only the permissions in the first table are available in the user interface. The permissions in the second table are available programmatically.

MAPI permissions available in the user interface

Groups of MAPI permissions available programmatically

Converting to MAPI Permissions

Exchange uses the following process to convert Windows 2000 permissions to MAPI permissions.

1. Convert the message ACEs, as described in the following table.

   Message ACEs

   Exchange 2003 permissions	MAPI permissions
   fsdrightReadProperty	frightsReadAny
   fsdrightWriteOwnProperty	frightsEditOwned
   fsdrightWriteProperty	frightsEditAny
   fsdrightDeleteOwnItem	frightsDeleteOwned
   fsdrightDelete	frightsDeleteAny

2. Convert the folder ACEs, as described in the following table.

   Folder ACEs

   Exchange 2003 permissions	MAPI permissions
   fsdrightCreateContainer	frightsCreateSubfolder
   fsdrightContact	frightsContact
   If all of the folder owner rights are present: fsdrightWriteProperty fsdrightOwner fsdrightWriteSD fsdrightDelete fsdrightWriteOwner fsdrightWriteAttributes fsdrightViewItem	frightsOwner
   fsdrightCreateItem	frightsCreate

3. For either folders or messages, if fsdrightViewItem is present, map it to frightsVisible.

4. Ensure that the converted permissions are internally consistent by making the following additional changes:

   • If frightsDeleteAny is granted, grant frightsDeleteOwned.

   • If frightsEditAny is granted, grant frightsEditOwned.

   • If frightsReadAny or frightsOwner is granted, grant frightsVisible.

Converting from MAPI Permissions

Exchange uses the following process to convert MAPI permissions to Windows 2000 permissions.

1. Expand the MAPI ACE into two ACEs.

   • An object-inherit/inherit-only (OI/IO) ACE (for messages; ignored on folders)

   • A container-inherit (CI) ACE (for folders; ignored on messages)

2. Convert the permissions in the ACEs, as described in the following table.

   Permissions in the ACEs

   MAPI permission	Exchange 2003 permission
   frightsEditAny	All of the legal generic write bits on messages (except delete)
   frightsDeleteAny	fsdrightDelete
   frightsEditOwned	fsdrightWriteOwnProperty
   frightsDeleteOwned	fsdrightDeleteOwnItem
   frightsReadAny	All of the legal generic read bits on messages All of the legal generic execute bits on messages, including fsdrightViewItem on messages On folder ACEs, this affects fsdrightViewItem
   frightsCreateSubfolder	fsdrightCreateContainer
   frightsOwner	fsdrightWriteProperty fsdrightOwner fsdrightWriteSD fsdrightDelete fsdrightWriteOwner fsdrightWriteAttributes fsdrightViewItem
   frightsContact	fsdrightContact
   frightsVisible	All of the legal generic read bits on folders All of the legal generic execute bits on folders fsdrightViewItem

3. Verify that the required Grant/Deny pairs of ACEs are present and in the correct sequence.

Examples of the Conversion Process

These examples illustrate the process of converting Windows 2000 permissions to MAPI permissions, and back again. As a starting point, consider a security descriptor on a folder in the Exchange store. The security descriptor contains two ACEs that specify permissions that are granted to the FolderUsers group:

• A folder ACE (an ACE that carries the CONTAINER_INHERIT_ACE flag)

• A message ACE (an ACE that carries the OBJECT_INHERIT_ACE and INHERIT_ONLY_ACE flags)

To simplify the discussion, these ACEs grant all applicable permissions to the FolderUsers group. Otherwise, two additional ACEs would be required to deny any permissions that were not granted.

The following table lists the permissions that are granted by the two ACEs.

Permissions specified by the FolderUsers group's two Grant ACEs

This example concentrates on the folder ACE. For the moment, it is not necessary to be concerned with the message ACE.

The following table shows how the Windows 2000 permissions map to MAPI permissions. Note that in many cases a single MAPI permission maps to a group of Windows 2000 permissions, and some of the Windows 2000 permissions are dropped.

Converting permissions

The mapping process shown above results in a folder ACE for the group FolderUsers that grants MAPI permissions.

To reverse the conversion, Exchange starts by duplicating the ACE to again produce a folder ACE and a message ACE as shown in The following table.

Duplicate ACEs

Next, Exchange converts the permissions, as shown in the following two tables.

Converting the folder ACE

Converting the message ACE

The preceding conversions produce the two Grant ACEs, as shown in the following table.

Permissions specified by the FolderUsers group's two Grant ACEs

The folder ACE and the message ACE effectively grant all of the available permissions to FolderUsers, so that the two corresponding Deny ACEs are not needed. Basically, these are the same two ACEs that were listed in the "Permissions specified by the FolderUsers group's two Grant ACEs" table, before any conversions took place.