A couple years ago I wrote a short article on an old blog about connecting to Active Directory from an ASP.net project. I thought the article was fairly complete until I tried to help somebody else do the same thing. I had forgotten two major parts:
- Manually sifting thru the different AD containers to find the right LDAP string.
- Ensuring the correct security context.
The security context can be an easy thing. A console or winforms .net app runs in the context of the currently logged on user. For simplicity the ASP.Net development server in Visual Studio does the same thing. So as long as your user account as access to the AD (which is the norm unless your AD admin has locked down querying), then you should be fine while you are developing.
Running under IIS is a different story. Depending on the version, the user context of the iis process could be all sorts of things - ASPNET, Network Service, Local Service, the new IIS app pool accounts, etc. During testing the easiest thing to do is enable impersonation:
<configuration>
<system.web>
<identity impersonate="true" userName="contoso\Jane" password="********" />
</system.web>
</configuration>
Optionally, you can remove the userName and password attributes and make sure that NTLM/Integrated security is still checked in the IIS configuration. This will make IIS operate similar to the ASP.Net Development Server and use the current user as the execution context.
So with the security context out of the way, the next task is to actually query AD for a user object. In my old example, I would specify the container to connect to whe creating a DirectoryEntry object. For example:
System.DirectoryServices.DirectoryEntry directoryEntry
= new System.DirectoryServices.DirectoryEntry(LDAP://CN=Users,DC=contoso,DC=com);
This worked fine for me but was a bit to limiting as an example to go by. Many domains have an additional "corp" domain context. "Users" might be named something different like "DomainUsers". There are all sorts of variables with AD. To combat this I added an extra query to "RootDSE" which is sort of the current context. With that I'm able to get the address of an actuall domain controller and from there, can make the query on a higher level. In the example below, I'm trying to get the AD User object for the currently authenticated user, but there's lots of diagnostic output that would let you find other things or narrow down the container that you're querying (for performance reasons).
<%@ Page Language="C#" %>
<%@ Import Namespace="System.DirectoryServices" %>
<%@ Import Namespace="System.Collections.Generic" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<script runat="server">
</script>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<script runat="server">
protected void Page_Load(object sender, EventArgs e)
{
OptLocalUser.Text = User.Identity.Name;
Dictionary<String, String> directoryPropertyDictionary;
//get the currently connected AD server info:
DirectoryEntry de = new DirectoryEntry("LDAP://RootDSE");
directoryPropertyDictionary = new Dictionary<string, string>(de.Properties.Count);
foreach (string key in de.Properties.PropertyNames)
{
String allValues = "";
foreach (object value in de.Properties[key])
allValues += value;
directoryPropertyDictionary.Add(key, allValues);
}
GridView1.DataSource = directoryPropertyDictionary;
GridView1.DataBind();
//connect to the current server
de = new DirectoryEntry("LDAP://" + de.Properties["dnsHostName"][0].ToString());
DirectorySearcher ds = new DirectorySearcher(de);
String[] nameParts = User.Identity.Name.Split('\\');
ds.Filter = "(&(objectClass=user)(sAMAccountName=" + nameParts[1] + "))";
SearchResult result = ds.FindOne();
OptUserPath.Text = result.Path;
directoryPropertyDictionary.Clear();
foreach (string key in result.Properties.PropertyNames)
{
String allValues = "";
foreach (object value in de.Properties[key])
allValues += value;
directoryPropertyDictionary.Add(key, allValues);
}
GridView2.DataSource = directoryPropertyDictionary;
GridView2.DataBind();
OptLocalUser.Text = User.Identity.Name;
}
</script>
</head>
<body>
<form id="form1" runat="server">
<div>
Local User:<asp:Label ID="OptLocalUser" runat="server" /><br/>
RootDSE:
<asp:GridView ID="GridView1" runat="server">
</asp:GridView>
AD User Path:<asp:Label ID="OptUserPath" runat="server" /><br/>
<asp:GridView ID="GridView2" runat="server">
</asp:GridView>
</div>
</form>
</body>
</html>