如何使用 LDAPS 知道当前 windows 用户是否在 AD 组中

Question

In order to secure my c# winform application, I need to know if the user who is currently logged in (windows 10) belongs to a group within the Active Directory The following code is working but I think it relies on LDAP and I need to do it through LDAPS

WindowsIdentity CurrentIdentity = WindowsIdentity.GetCurrent(); System.Security.Principal.WindowsPrincipal MyPrincipal = new System.Security.Principal.WindowsPrincipal(CurrentIdentity); return MyPrincipal.IsInRole("TESTGROUP");

How can I achieve this without forcing the user to re-enter login/password within the application whereas he has already logged in windows? Is it possible?

Thanx in advance

Answer 1

How can I achieve this without forcing the user to re-enter login/password within the application whereas he has already logged in windows? Is it possible?

Find an LDAP client library that supports either GSSAPI or GSS-SPNEGO authentication via SSPI (the Windows GSSAPI library).

In order to secure my c# winform application, I need to know if the user who is currently logged in (windows 10) belongs to a group within the Active Directory The following code is working but I think it relies on LDAP and I need to do it through LDAPS

If it does, then it relies on Kerberos-protected LDAP. You probably don't need LDAPS on top of that. Active Directory LDAP and RPC communications are already secured in this way – they don't just use Kerberos for authentication, but for transport encryption as well (each Kerberos ticket carries an AES session key), and the nature of Kerberos ensures the server's identity in the same way as a TLS certificate would.

(Although it seems that the function actually uses not LDAP but.NETLOGON Secure Channel – the same one that Windows uses to retrieve the user's information during OS login.)

However, a client-side group check doesn't really secure the app itself. If you are worried about someone who's capable of faking the LDAP traffic – your C# WinForms application will be trivial to decompile and to remove any client-side restrictions (and to steal any embedded credentials that the app might use). The only real security comes from server-side checks (eg restricting database access via server-side ACLs).