.NET C＃中的LDAP连接

Question

I have an application where I can send emails. Now am asked to use ldap to authenticate the user email. Am very new to this concept. I have been given a ldap server link. No idea how to proceed with that. Any article or hits will be greatly helpful.

Here is the code am trying with

public static UserDetail GetUserDetails(string EmailId, string domainName)
{
    UserDetail userDetail = new UserDetail();

    try
    {
        string filter = string.Format("(&(ObjectClass={0})(sAMAccountName={1}))", "person", EmailId);
        string[] properties = new string[] { "fullname" };

        DirectoryEntry adRoot = new DirectoryEntry("LDAP://" + domainName, null, null, AuthenticationTypes.Secure);
        DirectorySearcher searcher = new DirectorySearcher(adRoot);
        searcher.SearchScope = SearchScope.Subtree;
        searcher.ReferralChasing = ReferralChasingOption.All;
        searcher.PropertiesToLoad.AddRange(properties);
        searcher.Filter = filter;
        SearchResult result = searcher.FindOne();

        DirectoryEntry directoryEntry = result.GetDirectoryEntry();
        string displayName = directoryEntry.Properties["displayName"[0].ToStrin();
        string firstName = directoryEntry.Properties["givenName"][0].ToString();
        string lastName = directoryEntry.Properties["sn"][0].ToString();
        string emailId = directoryEntry.Properties["mail"][0].ToString();

        userDetail.EmailId = emailId;
    }
    catch (Exception)
    {

    }
    return userDetail;
}

I want to achieve it on click of search button. How do I call the method and pass variables.

Answer 1

If you're on .NET 3.5 or newer, you can use a PrincipalSearcher and a "query-by-example" principal to do your searching:

// create your domain context
PrincipalContext ctx = new PrincipalContext(ContextType.Domain);

// define a "query-by-example" principal - here, we search for a UserPrincipal 
// and with the e-mail of "bruce@example.com"
UserPrincipal qbeUser = new UserPrincipal(ctx);
qbeUser.EmailAddress = "bruce@example.com";

// create your principal searcher passing in the QBE principal    
PrincipalSearcher srch = new PrincipalSearcher(qbeUser);

// try to find that user
UserPrincipal found = srch.FindOne() as UserPrincipal;

if(found != null)
{
    // do whatever here - "found" is the user that matched the e-mail given
}
else
{
    // there wasn't any user with that e-mail address in your AD
}

If you haven't already - absolutely read the MSDN article Managing Directory Security Principals in the .NET Framework 3.5 which shows nicely how to make the best use of the new features in System.DirectoryServices.AccountManagement . Or see the MSDN documentation on the System.DirectoryServices.AccountManagement namespace.

Of course, depending on your need, you might want to specify other properties on that "query-by-example" user principal you create:

• DisplayName (typically: first name + space + last name)
• SAM Account Name - your Windows/AD account name
• User Principal Name - your "username@yourcompany.com" style name

You can specify any of the properties on the UserPrincipal and use those as "query-by-example" for your PrincipalSearcher .

Answer 2

Given the input of emailAddress (type string) this code will search the LDAP directory for a user with a matching email address and return some information on the user:

string fullName = string.Empty;
            string givenName = string.Empty;
            string distinguishedName = string.Empty;
            string sAMAccountName = string.Empty;
            using (var context = new PrincipalContext(ContextType.Domain, "DOMAIN"))
            {
                using (var searcher = new PrincipalSearcher(new UserPrincipal(context)))
                {
                    foreach (Principal result in searcher.FindAll())
                    {
                        var de = result.GetUnderlyingObject() as DirectoryEntry;

                        if (de.Properties["cn"].Value.ToString().Contains(" "))
                        {

                            //var userEntry = new DirectoryUser(de.Properties["sAMAccountName"].Value.ToString());
                            var currentUserEmail = de.Properties["mail"].Value.ToString().ToLower();
                            if (currentUserEmail == emailAddress)
                            {

                                if (de.Properties["cn"].Value != null)
                                    fullName = de.Properties["cn"].Value.ToString();
                                if (de.Properties["givenName"].Value != null)
                                   givenName = de.Properties["givenName"].Value.ToString();
                                if (de.Properties["distinguishedName"].Value != null)
                                    distinguishedName =de.Properties["distinguishedName"].Value.ToString();
                                if (de.Properties["sAMAccountName"].Value != null)
                                    sAMAccountName = de.Properties["sAMAccountName"].Value.ToString();


                            }
                        }
                    }
                }
            }

It requires a reference to :

System.DirectoryServices;
System.DirectoryServices.AccountManagement;

One caveat I would like to mention is, directory look up routines can be quite slow. If you have 100,000 users on your domain, this process will take a while to run. WHat I tend to do, is dump the output of a directory search to a database table on a regular basis, and perform any lookups on that table. The frequency of the database dumps will of course depend on your business logic. Sometimes I simply truncate the table before performing a new dump, and in other circumstances, I dump to a 'staging' table, and only apply 'delta' updates to the active directoy record table.

Answer 3

• Connect to the directory server, using SSL if possible. Promoting a non-secure connection to a secure connection with the StartTLS extended operation is also possible.
• Transmit a SEARCH request to the server that contains the base DN from which the client wishes the search to begin, the scope of the search (base, one-level, or sub-tree), a filter using the information the LDAP client knows that will narrow the search results to the desired user, and the attribute 1.1 .
• The server will respond with the a SEARCH response containing the number of entries that matched the search request parameters and the distinguished names of each entry that matched.
• Transmit a BIND request to the directory server over the secure connection. The BIND request contains a distinguished name and the credentials for the distinguished name
• The directory server will verify the credentials and return a BIND response with an integer result code indicating whether the credentials matched those stored in the server database

see also

• LDAP: programming practices
• LDAP: search practices