如何使iis中托管的wcf服务访问另一个服务器活动目录

Question

how to make wcf service hosted in iis access another server active directory

there are 2 servers 1- Application server which WCF service hosted on IIS 2- Active directory server all I want to do is make this WCF access active directory to add,edit or remove users

how to make the WCF service access the AD of another server in the same network I'm working on intranet portal where user can sign in with their Windows credentials "AD" and want to develop an administration page to add users to "AD"

the wcf services which create users in "AD" don't have permission to do it how could I do that ?

    public bool AddActiveDirectoryUser(ADUser User)
    {
        string userLoginName = User.Email.Split("@".ToArray())[0];
        // Creating the PrincipalContext
        PrincipalContext principalContext = null;
        try
        {
            principalContext = new PrincipalContext(ContextType.Domain, ADServer, ADPath.Substring(ADPath.IndexOf("DC")), ADUser, ADPassword);

        }
        catch (Exception e)
        {
            WriteLog(e);
            return false;
        }


        UserPrincipal usr = UserPrincipal.FindByIdentity(principalContext, userLoginName);
        if (usr != null)
        {
            WriteLog(Enum.LogType.Error, userLoginName + " already exists. Please use a different Username.");
            return false;
        }

        // Create the new UserPrincipal object
        UserPrincipal userPrincipal = new UserPrincipal(principalContext);

        if (!string.IsNullOrEmpty(User.LastName) && User.LastName.Length > 0)
            userPrincipal.Surname = User.LastName;

        if (!string.IsNullOrEmpty(User.FirstName) && User.FirstName.Length > 0)
            userPrincipal.GivenName = User.FirstName;

        if (!string.IsNullOrEmpty(User.Email) && User.Email.Length > 0)
            userPrincipal.EmailAddress = User.Email;


        if (!string.IsNullOrEmpty(userLoginName) && userLoginName.Length > 0)
            userPrincipal.SamAccountName = userLoginName;

        userPrincipal.SetPassword("123456");

        userPrincipal.Enabled = true;
        userPrincipal.PasswordNeverExpires = true;

        try
        {
            userPrincipal.Save();

//here it throw an exception access denied !!!!?

        }
        catch (Exception e)
        {
            WriteLog(e);
            return false;
        }
        return true;
    }

Answer 1

Ok, given the information you gave the problem is the following. The user you use to create the context doesn't have the enough permissions to perform these tasks. You need to grant permissions to this user on he OU the users are created in and all problems should go away.

Check this post for more information on the subject https://serverfault.com/questions/190566/what-permissions-are-needed-for-a-helpdesk-admin-to-create-users-in-ad