Active Directory hierarchy member of group: Active Directory, .NET, c#

Active Directory hierarchy member of group

Asked by: Poidda

Hi,

I am having a problem searching Active directory to see if a user is a member of the group. The following code works just fine if the user is in the group you pass, but I need to search all subgroups as well? I am new to working with AD. Any help would be greatly appreciated.

This is what I have to search the current group.

public static ActiveDirectoryUserCollection GetUsersInRole(string roleName)
{
ActiveDirectoryUserCollection users = new ActiveDirectoryUserCollection();
DirectorySearcher userSearch = null;
DirectoryEntry userDE = null;

userSearch = ActiveDirectoryUtility.CreateNewDirectorySearcher();
userSearch.PropertiesToLoad.Add(ActiveDirectoryUtility.LdapAttributeMember);
userSearch.SearchScope = SearchScope.Subtree;
userSearch.Filter = "(&(objectCategory=group)(cn=" + roleName + "))";
userSearch.Sort = new SortOption("sn", SortDirection.Ascending);
SearchResult groupResult = userSearch.FindOne();

if (groupResult != null)
{
for (int groupIndex = 0; groupIndex < groupResult.Properties["member"].Count; groupIndex++)
{
userDE = new DirectoryEntry("LDAP://" + groupResult.Properties["member"][groupIndex].ToString());

if (userDE != null)
{
ActiveDirectoryUser user = new ActiveDirectoryUser();
user.ParentHashCode = users.GetHashCode();
user.AdsPath = userDE.Path;
user.givenName = GetPropertyCollectionString(userDE.Properties, "givenName");
user.sn = GetPropertyCollectionString(userDE.Properties, "sn");
user.samAccountName = GetPropertyCollectionString(userDE.Properties, "samAccountName");
users.Add(user);
}
}
}
}

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation

Collaborate with the world's top tech experts

Unlimited access to our exclusive solution database

Never be left without tech help again

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.

"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin

"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

You'll need to use a recursive test of group membership. I wrote something to do that in VbScript, it won't directly translate but perhaps it'll give you enough of an idea. I certainly don't know enough C# to write it in that :)

strGroup is the group you're testing, arrGroups is an array returned from the "memberOf" attribute. And x is a simple counter (not used for anything other than displaying output as a tree).

In essence, you pass the array through to a subroutine, loop through the contents of that array as a basic member of, and passing each sub-groups memberOf array back to the Subroutine.

It gets a bit hairy if you have to protect against circular nesting, hopefully you won't need to.

HTH

Chris

Function RecursiveIsMember(strGroup, arrGroups, x)
	' Return Type: Boolean
	' 
	' Goes through Nested Groups until either booIsMember is True or there are no more groups to check
	
	Dim objUser, objGroup
	Dim strGroupDN
	Dim arrTemp
	Dim booIsMember
 
	booIsMember = False
 
	On Error Resume Next
 
	For Each strGroupDN in arrGroups
		Err.Clear
		Set objGroup = GetObject("LDAP://" & strGroupDN)
		' WScript.Echo Space(x) & objGroup.Get("name")
		If Err.Number = 0 Then
			If LCase(objGroup.Get("name")) = LCase(strGroup) Then
				booIsMember = True
				Exit For
			Else
				Err.Clear
				arrTemp = objGroup.GetEx("memberOf")
				If Err.Number = 0 Then
					y = x + 2
					booIsMember = IsMember(strGroup, arrTemp, y)
					If booIsMember = True Then
						Exit For
					End If
				End If
			End If
		End If
		Set objGroup = Nothing
	Next
	On Error Goto 0
	IsMember = booIsMember
End Function

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:

Select all Open in new window

Question

Active Directory hierarchy member of group

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Active Directory, .NET, c#

Lightweight Directory Access Protocol (LDAP)