C＃查询Active Directory

Question

I am developing an Intranet web app and I am using the System.DirectoryServices.AccountManagement to query the Active Directory of the current user's Windows Identity. On my development machine, the query returns a UserPrincipal populated with the user information. The application directory under Default Web Site of the local IIS on my machine has Windows authentication and Impersonate enabled. However, when the application is published to our hosting IIS, the Principal is returned but with no user information. Does anyone know why? The server admin said that I have to use a service account and password to connect to AD server to do the query. If it's true, then querying from my local machine should have not worked either. Is this correct?

public class LDAP_Helper
{
    public string NetworkName { get; private set; }
    public string LastName { get; private set; }
    public string FirstName { get; private set; }
    public string MiddleName { get; private set; }
    public string Email { get; private set; }
    public string VoicePhone { get; private set; }

    public LDAP_Helper()
    {
        using (var context = new System.DirectoryServices.AccountManagement.PrincipalContext(
            System.DirectoryServices.AccountManagement.ContextType.Domain))
        {
            try
            {
                string currentUser = HttpContext.Current.User.Identity.Name;
                var principal = System.DirectoryServices.AccountManagement.UserPrincipal.FindByIdentity(context, currentUser);

                NetworkName = principal.SamAccountName;
                LastName = principal.Surname;
                FirstName = principal.GivenName;
                MiddleName = principal.MiddleName;
                Email = principal.EmailAddress;
                VoicePhone = principal.VoiceTelephoneNumber;
            }
            catch { }

        }

        return;
    }

Web.config settig:

    <identity impersonate="true" />

Answer 1

First off, you catch all exceptions and do nothing about them, so that's not good. If you did handle the exception, you would probably get first a PrincipalOperationException telling you that no user by that name was found, and then 6 NullReferenceExceptions because your principal variable is Nothing. I am not a C# guy, but this VB bit should not be too hard to translate. You should also specify the domain when you create the context to avoid problems on networks with multiple domain controllers. You do need to have permissions to query the Active Directory server, but by no means does that have to be a service account. Just a regular account with the appropriate group membership.

 Public Function FindUserPrincipal(ByVal userName As String) As UserPrincipal
    Try
        Return UserPrincipal.FindByIdentity(New PrincipalContext(ContextType.Domain, "mydomain"), IdentityType.SamAccountName, userName)
    Catch ex As PrincipalOperationException
        Return Nothing
    End Try
End Function

You can also narrow your search to a single organizational unit on the server by specifying the search root in the form of a LDAP distinguished name when you create the context, that can significantly improve performance on large networks.

Private Function GetPrincipalContext(ByVal domain As String, ByVal ldapDn As String) As PrincipalContext
    Try
        If String.IsNullOrWhiteSpace(ldapDn) Then
            Return New PrincipalContext(ContextType.Domain, domain)
        Else
            Return New PrincipalContext(ContextType.Domain, domain, ldapDn)
        End If
    Catch ex As PrincipalOperationException
        Return Nothing
    End Try
End Function

Answer 2

You can specify a username and password in the PrincipalContext constructor to connect to the store with. Here's the MSDN documentation link.

Answer 3

The easiest way to deal with this would be to setup a WCF service to handle interaction with Active Directory, and have your web app query that service, running under a privileged account. This way only the service needs to run elevated, the client just needs to be able to reach the service.