LDAP-从IIS获取用户的组名失败

Question

I followed a tutorial to implement LDAP authentication on an ASP.NET/C# 4.0 Web Application. While things do seem to work, when I put the website under IIS7, it fails to obtain the group names.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Text;
using System.Collections;
using System.DirectoryServices;
using System.DirectoryServices.ActiveDirectory;

namespace KEWeb
{
    public class LdapAuthentication
    {
        private string _path;
        private string _filterAttribute;
        private string _username;
        private string _password;
        private string _domain;
        private string _domainAndUsername;
        private DirectoryEntry _entry;
        private DirectorySearcher _search;
        private SearchResult _result;

        public LdapAuthentication(string path, string domain, string username, string password)
        {
            _path = path;
            _domain = domain;
            _username = username;
            _password = password;
            _domainAndUsername = _domain + @"\" + _username;
            _entry = new DirectoryEntry(_path, _domainAndUsername, _password);

        }

        public bool IsAuthenticated()
        {
            try
            {
                Object obj = _entry.NativeObject;
                _search = new DirectorySearcher(_entry);
                _search.Filter = "(SAMAccountName=" + _username + ")";
                _search.PropertiesToLoad.Add("cn");
                _result = _search.FindOne();
                if (null == _result) { return false; }
                _path = _result.Path;
                _filterAttribute = (String)_result.Properties["cn"][0];
            }
            catch (Exception ex) { throw new Exception("Error authenticating user: " + ex.Message); }
            return true;
        }

        public string GetGroups()
        {
            string r = "";
            try
            {
                Object obj = _entry.NativeObject;
                _search = new DirectorySearcher(_entry);
                _search.Filter = "(SAMAccountName=" + _username + ")";
                _search.PropertiesToLoad.Add("cn");
                _result = _search.FindOne();
                if (null != _result)
                {
                    _path = _result.Path;
                    _filterAttribute = (String)_result.Properties["cn"][0];
                    _search = new DirectorySearcher(_path);
                    _search.Filter = "(cn=" + _filterAttribute + ")";
                    _search.PropertiesToLoad.Add("memberOf");
                    StringBuilder groupNames = new StringBuilder();
                    _result = _search.FindOne();
                    int propertyCount = _result.Properties["memberOf"].Count;
                    String dn;
                    int equalsIndex, commaIndex;
                    for (int propertyCounter = 0; propertyCounter < propertyCount; propertyCounter++)
                    {
                        dn = (String)_result.Properties["memberOf"][propertyCounter];
                        equalsIndex = dn.IndexOf("=", 1);
                        commaIndex = dn.IndexOf(",", 1);
                        if (-1 == equalsIndex) { return null; }
                        groupNames.Append(dn.Substring((equalsIndex + 1), (commaIndex - equalsIndex) - 1));
                        groupNames.Append("|");
                    }
                    r = groupNames.ToString();
                }
            }
            catch (Exception ex) { throw new Exception("Error obtaining group names: " + ex.Message); }

            return r;
        }
    }
}

When running this in debug from Visual Studio 2010, it works fine. But on IIS7, it gives an error An operations error occured. Not sure how to debug this while under IIS, although I'm sure it's possible. If I completely ignore GetGroups() and comment that code out, it works, but of course I need these group names.

PS - Yes, the code above is nothing like the original, I tweaked it to re-use some redundant stuff. I did however have this issue before I changed that.

Answer 1

you're searching using the wrong item for the groups - you need to use:

_search = new DirectorySearcher(_path);

in the GetGroups() call. The _path variable is set by the IsAuthenticated() call.

Answer 2

You can debug an application under iis, if you attach to the w3wp process. Use the CTRL+Alt+P hotkey to attach to it, or go to Debug menu and choose Attach to Process... and check in the "Show processes in all sessions" checkbox.

Answer 3

This may be way too late to help but I had exactly the same issue.

For me it was the IIS Site had ASP.Net Impersonation and Anonymous both enabled and the Impersonation user was configured to use authenticated user. Since Anonymous was also enabled, this would always fail since Anonymous users do NOT have access to AD.

Changed ASP.Net Impersonation to use a valid AD account and voila!

John

PS. I was working from the same tutorial as you as well. :)