查找用戶是否是 Active Directory 組 ASP.NET VB 的成員？

Question

我正在使用 Active Directory 對 Intranet 站點的用戶進行身份驗證。 我想根據他們在 Active Directory 中所在的組來優化經過身份驗證的用戶。 有人可以向我展示或指出有關如何在 ASP.NET 4.0 (VB) 中查找用戶所在組的說明嗎？

Answer 1

我意識到這篇文章已經很舊了，但我想我可能會用我正在使用的進程更新它。 (ASP.Net 4.0, VB)

如果使用集成的 Windows 安全性，則在域上。

Page.User.IsInRole("domain\\GroupName")將檢查通過身份驗證的用戶是否是指定組的成員。

如果您想檢查經過身份驗證的用戶以外的其他用戶組成員身份。

檢查具有相同用戶主體的多個組的兩個階段：

Dim MyPrincipal As New System.Security.Principal.WindowsPrincipal _
     (New System.Security.Principal.WindowsIdentity("UserID"))
Dim blnValid1 As Boolean = MyPrincipal.IsInRole("domain\GroupName")

單階段簽入單個組：

Dim blnValid2 As Boolean = New System.Security.Principal.WindowsPrincipal _
     (New System.Security.Principal.WindowsIdentity("userID")).IsInRole("domain\GroupName")

注意:: IsInRole 方法確實適用於嵌套組。 如果您有一個頂級組和一個作為成員的子組，並且用戶是該子組的成員。

Answer 2

我想我有最終的功能來讓一個用戶的所有 AD 組包含嵌套組，而無需顯式遞歸：

導入 System.Security.Principal

Private Function GetGroups(userName As String) As List(Of String)
    Dim result As New List(Of String)
    Dim wi As WindowsIdentity = New WindowsIdentity(userName)

    For Each group As IdentityReference In wi.Groups
        Try
            result.Add(group.Translate(GetType(NTAccount)).ToString())
        Catch ex As Exception
        End Try
    Next

    result.Sort()
    Return result
End Function

所以只需使用 GetGroups("userID")。 由於此方法使用用戶的 SID，因此不會執行顯式 LDAP 調用。 如果您使用自己的用戶名，它將使用緩存的憑據，因此此功能非常快。

Try Catch 是必要的，因為在大型公司中，AD 非常大，以至於一些 SID 會丟失在空間中。

Answer 3

對於那些可能感興趣的人，這就是我最終編碼的方式：

Dim ID As FormsIdentity = DirectCast(User.Identity, FormsIdentity)
    Dim ticket As FormsAuthenticationTicket = ID.Ticket
    Dim adTicketID As String = ticket.Name
    Dim adSearch As New DirectorySearcher
    adSearch.Filter = ("(userPrincipalName=" & adTicketID & ")")
    Dim adResults = adSearch.FindOne.Path
    Dim adResultsDirectory As New DirectoryEntry(adResults)
    Dim found As Boolean = False
    For Each entry In adResultsDirectory.Properties("memberOf")
        Response.Write(entry)
        Response.Write("<br/>")
        If entry = "CN=GroupName,CN=UserGroup,DC=my,DC=domain,DC=com" Then
            found = True
        End If

    Next
    If Not (found) Then
        Response.Redirect("login.aspx")
    End If

Answer 4

我在這里找到了這個。

''' <summary>
''' Function to return all the groups the user is a member od
''' </summary>
''' <param name="_path">Path to bind to the AD</param>
''' <param name="username">Username of the user</param>
''' <param name="password">password of the user</param>
Private Function GetGroups(ByVal _path As String, ByVal username As String, _
                 ByVal password As String) As Collection
    Dim Groups As New Collection
    Dim dirEntry As New _
        System.DirectoryServices.DirectoryEntry(_path, username, password)
    Dim dirSearcher As New DirectorySearcher(dirEntry)
    dirSearcher.Filter = String.Format("(sAMAccountName={0}))", username)
    dirSearcher.PropertiesToLoad.Add("memberOf")
    Dim propCount As Integer
    Try
        Dim dirSearchResults As SearchResult = dirSearcher.FindOne()
        propCount = dirSearchResults.Properties("memberOf").Count
        Dim dn As String
        Dim equalsIndex As String
        Dim commaIndex As String
        For i As Integer = 0 To propCount - 1
            dn = dirSearchResults.Properties("memberOf")(i)
            equalsIndex = dn.IndexOf("=", 1)
            commaIndex = dn.IndexOf(",", 1)
            If equalsIndex = -1 Then
                Return Nothing
            End If
            If Not Groups.Contains(dn.Substring((equalsIndex + 1), _
                                  (commaIndex - equalsIndex) - 1)) Then
                Groups.Add(dn.Substring((equalsIndex + 1), & _
                                       (commaIndex - equalsIndex) - 1))
            End If
        Next
    Catch ex As Exception
        If ex.GetType Is GetType(System.NullReferenceException) Then
            MessageBox.Show("Selected user isn't a member of any groups " & _
                            "at this time.", "No groups listed", _
                            MessageBoxButtons.OK, MessageBoxIcon.Error)
            'they are still a good user just does not
            'have a "memberOf" attribute so it errors out.
            'code to do something else here if you want
        Else
            MessageBox.Show(ex.Message.ToString, "Search Error", & _
 MessageBoxButtons.OK, MessageBoxIcon.Error)
        End If
    End Try
    Return Groups
End Function
End Class

Answer 5

要檢查用戶是否是包括子組在內的組的成員，請使用：

    Public Function IsInGroup(ByVal objectName As String, groupName As String) As Boolean
        Try
            return New WindowsPrincipal(New WindowsIdentity(objectName)).IsInRole(groupName))
        Catch ex As Exception
        End Try

        Return False
    End Function