Rights that is needed to access the Active Directory?

Question

Hi,

I have a service hosten in IIS that runnes this code :

DirectoryEntry objADAM = default(DirectoryEntry);
            // Binding object. 
            DirectoryEntry objGroupEntry = default(DirectoryEntry);
            // Group Results. 
            DirectorySearcher objSearchADAM = default(DirectorySearcher);
            // Search object. 
            SearchResultCollection objSearchResults = default(SearchResultCollection);
            // Binding path. 
            ActiveDirectory result = new ActiveDirectory();
            ActiveDirectoryItem treeNode;

            // Get the AD LDS object. 
            try
            {
                if (pathToAD.Length > 0)
                    objADAM = new DirectoryEntry(pathToAD);
                else
                    objADAM = new DirectoryEntry();
                objADAM.RefreshCache();
            }
            catch (Exception e)
            {
                throw e;
            }

            // Get search object, specify filter and scope, 
            // perform search. 
            try
            {
                objSearchADAM = new DirectorySearcher(objADAM);
                objSearchADAM.Filter = "(&(objectClass=group))";
                objSearchADAM.SearchScope = SearchScope.Subtree;
                objSearchResults = objSearchADAM.FindAll();
            }
            catch (Exception e)
            {
                throw e;
            }

            // Enumerate groups 
            try
            {
                if (objSearchResults.Count != 0)
                {
                    //SearchResult objResult = default(SearchResult);
                    foreach (SearchResult objResult in objSearchResults)
                    {
                        objGroupEntry = objResult.GetDirectoryEntry();
                        result.ActiveDirectoryTree.Add(new ActiveDirectoryItem() { Id = objGroupEntry.Guid, ParentId = objGroupEntry.Parent.Guid, AccountName = objGroupEntry.Name, Type = ActiveDirectoryType.Group, PickableNode = false });

                        foreach (object child in objGroupEntry.Properties["member"])
                        {
                            treeNode = new ActiveDirectoryItem();
                            var path = "LDAP://" + child.ToString().Replace("/", "\\/");
                            using (var memberEntry = new DirectoryEntry(path))
                            {

                                if (memberEntry.SchemaEntry.Name.CompareTo("group") != 0 && memberEntry.Properties.Contains("sAMAccountName") && memberEntry.Properties.Contains("objectSid"))
                                {
                                    treeNode.Id = Guid.NewGuid();
                                    treeNode.ParentId = objGroupEntry.Guid;
                                    treeNode.AccountName = memberEntry.Properties["sAMAccountName"][0].ToString();
                                    treeNode.Type = ActiveDirectoryType.User;
                                    treeNode.PickableNode = true;
                                    treeNode.FullName = memberEntry.Properties["Name"][0].ToString();

                                    byte[] sidBytes = (byte[])memberEntry.Properties["objectSid"][0];
                                    treeNode.ObjectSid = new System.Security.Principal.SecurityIdentifier(sidBytes, 0).ToString();

                                    result.ActiveDirectoryTree.Add(treeNode);
                                }
                            }
                        }
                    }
                }
                else
                {
                    throw new Exception("No groups found");
                }
            }
            catch (Exception e)
            {
                throw new Exception(e.Message);
            }

            return result;

This works fine in my dev enviroment but at a customer we get this exception :

The specified directory service attribute or value does not exist

I supose that this could have to do with the rights to the Active Directory?

What account needs ActiveDirectory and what level of rights is needed?

Answer 1

The account running the thread needs to have read rights to AD. All domain accounts have this permission.

To cut a long story short, verify that the value of HttpContext.Current.User.Identity.Name is a domain account.

If the web application is configured to have anonymous access, then most likely it won't be.