如何在具有子组的Active Directory组中找到用户？

Question

I have a Problem with ASP.NET and Active Directory.

I want to find out whether the User is in a Groupe of the Active Directory and if he is in this Group he can see more. For this I write a Function with a filterstring. The Problem is that in our company we switch the Groups and the structure is not static. For this I search the Group first and than I search a user in the Group with the parameter member-of...

here is the structure of our AD:

Here is my Code for saerch the group:

public string GetGroup(string groupname)
        {
            string path = "<OurDomain>";

            DirectoryEntry rootEntry = new DirectoryEntry(path);

            DirectorySearcher srch = new DirectorySearcher(rootEntry);
            srch.SearchScope = SearchScope.Subtree;

            srch.Filter = "(&(objectCategory=Group)(name=" + groupname + "))";

            SearchResult resFilter = srch.FindOne();

            string filterpath = resFilter.Path;

            return filterpath; 
        }

My method for find the user:

public bool IsUserInGroup(string username,string groupepath) 
        {
            string path = "<OurDomain>"; 

            DirectoryEntry rootEntry = new DirectoryEntry(path);

            DirectorySearcher srch = new DirectorySearcher(rootEntry);
            srch.SearchScope = SearchScope.Subtree;

            srch.Filter = "(&(objectClass=user)(sAMAccountName=*" + username + "*)(memberof=CN=GastzugangUser,OU=SubFolderB,OU=FolderB,DC=company,DC=com))";


            SearchResultCollection res = srch.FindAll();

            if (res == null || res.Count <= 0)
            {
                return false;
            }
            else
            {
                return true; 
            }
        }

How I can search a User in the SubGroups of a Group and that dynamic? :(

Answer 1

Didn't try that but does adding this to the filter help? http://ldapwiki.willeke.com/wiki/1.2.840.113556.1.4.1941

eg

(&(objectClass=user)(sAMAccountName=*" + username + "*)(memberof:1.2.840.113556.1.4.1941:=CN=GastzugangUser,OU=SubFolderB,OU=FolderB,DC=company,DC=com))";

Answer 2

If you're on .NET 3.5 and up, you should check out the System.DirectoryServices.AccountManagement (S.DS.AM) namespace. Read all about it here:

• Managing Directory Security Principals in the .NET Framework 3.5
• MSDN docs on System.DirectoryServices.AccountManagement

Basically, you can define a domain context and easily find users and/or groups in AD:

// set up domain context
using (PrincipalContext ctx = new PrincipalContext(ContextType.Domain))
{
  // find a user
  UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");

  if(user != null)
  {
      // GetAuthorizationGroups returns a list of GroupPrincipals and work recursively
      var groupsForUser = user.GetAuthorizationGroups();

      // then check to see if that group you want it part of this list
  }
}

The new S.DS.AM makes it really easy to play around with users and groups in AD!