使用两个不同的域进行验证

Question

I am currently working on a validation step for a new project. All the code is working except for this part (as described below). I am trying to check is a user (domain1) is in a group of domain2. Everything I am trying is returning a null for the user, and I am not sure why.

Here is the function that I am using.

public void runTask(string serverName, string taskName)
        {
            PrincipalContext ctx = new PrincipalContext(ContextType.Domain, domain);
            UserPrincipal user = UserPrincipal.FindByIdentity(ctx, loginWindow.getUsername());
            GroupPrincipal group = GroupPrincipal.FindByIdentity(ctx, ADGroup);


            if (user.IsMemberOf(group))
            {
                using (TaskService tasksrv = new TaskService(serverName, loginWindow.getUsername(), domain, loginWindow.getPassword()))
                {
                    Microsoft.Win32.TaskScheduler.Task task = tasksrv.FindTask(taskName);
                    if (!task.IsActive)
                    {
                        if (task.Enabled == true)
                        {
                            //task.Run();
                        }
                        else
                        {
                            log.LogMessage("Task was disabled. Enabling...");
                            task.Enabled = true;
                            //task.Run();
                        }
                    }
                    else
                    {
                        // send email
                        string body = "User: " + loginWindow.getUsername().ToUpper() + "<br/><br/>" + "Server: " + serverName + "<br/><br/>" + task.Name + " is already running.";

                        // send email confirmation
                        email = new Email(false);
                        email.SendMail(toEmail, fromEmail, serverName + subject, body);

                    }
                }
            }
        }

When I set domain = where the username exists it returns a value but does not find the ADGroup. When I switch it to the domain of the ADGroup, the user is null.

loginWindow is a simple class that validates the users credentials. Task is the windows task that I am trying to run.

Any thoughts or tips would be helpful because right now I am at a loss.

Thanks!

Answer 1

Well, from the code it looks like you're using the same domain-scoped PrincipalContext object to look up both the user and the group and since they are actually in different domains then at least each lookup should be performed using its own context:

        PrincipalContext userCtx = new PrincipalContext(ContextType.Domain, domain1);
        UserPrincipal user = UserPrincipal.FindByIdentity(userCtx, loginWindow.getUsername());

        PrincipalContext groupCtx = new PrincipalContext(ContextType.Domain, domain2);
        GroupPrincipal group = GroupPrincipal.FindByIdentity(groupCtx, ADGroup);

This should give you non-null results for both user and group . I'm not sure, though, if user.IsMemberOf(group) would work. Active Directory uses foreignSecurityPrincipal records to keep records of cross-domain group membership and it's only using the members attribute of the group for that. The user record does not get a matching memberOf record. See my answer here for details.