从 C++ 应用程序中，如何检查 Active Directory 中的特定用户是否属于特定安全组？

Question

I'm currently working on a C++ application that needs to authenticate a user against the Active Directory on our domain (which I have working), and then also check if that user is part of a particular security group in that Active Directory. I've been using WinLDAP to authenticate ( https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ldap/establishing-an-ldap-session ), and I've had no problems there. The problem is that there doesn't seem to be anything in the API for checking which security groups a user belongs to (in our Active Directory), or checking if they are a member of a specific group.

I've found some answers in other threads, but they either (1) are written in C# or (2) only tell you how to check the Active Directory groups for the current user on that Windows machine, which is not what I need. The current user on the PC might not be the same person logging into our application, or they might use a different account to log into their PC than they use for authenticating against the Active Directory. I need to be able to specify the user I'm checking the security groups for.

The solution doesn't need to use LDAP, but it does need to work in C++ and Windows. Our application also uses Qt, so I'm certainly open to options that require Qt. I'm really just looking for a simple way to say "Does user [X] belong to group [Y] in the Active Directory on domain [Z]". Alternatively, it could work as "List all groups that user [X] belongs to in the Active Directory on domain [Z]". Either one is perfectly fine, as long as I can specify the user name in the AD, meaning it doesn't just operate on the current Windows user account. Any help would be greatly appreciated!

Answer 1

You can use Active Directory Service Interfaces (ADSI) to do this. There's a C++ example of binding to a user account using ADsGetObject here: Binding With GetObject and ADsGetObject

If you specify IID_IADsUser as the riid parameter, you can get an IADsUser object, and then use IADsUser::Groups to get all the groups that the user is a member of.

The C# examples can still be helpful to you, since the System.DirectoryServices namespace is really just a wrapper around ADSI. For example, this C#:

var user = new DirectoryEntry("LDAP://CN=jeffsmith,DC=fabrikam,DC=com");

is equivalent to this in C++:

hr = ADsGetObject(L"LDAP://CN=jeffsmith,DC=fabrikam,DC=com", IID_IADsUser, (void**) &pUser);

DirectoryEntry.Properties is equivalent to IADs::Get / IADs::GetEx

DirectoryEntry.RefreshCache is equivalent to IADs::GetInfo / IADs::GetInfoEx

DirectoryEntry.CommitChanges is equivalent to IADs::SetInfo