Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1106
  • Last Modified:

LDAP Problem with Memberof information

I am developing an asp.net web service which interact with Active Directory(through LDAP) and returns user information.

The web service is working perfect every thing except the memberof information.It is not returning the MemberOf(group name) information for all the users except me,Ie is if query the AD from my system using my UserID it returns my MemberOf info but if use any other person ID it returns all the information except memberOf.I think it is a security issue,I have seen a post in experts-exchange previously,
http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_23577274.html
 it suggests to use impersonation to solve this problem, but it is an classic asp application, Can any one tell me how to solve my problem in asp.net.

Thanks
[WebMethod]
    public XmlDocument GetADgroupsForPerson(string oParam)
    {
 
        {
            XmlDocument doc = new XmlDocument();
            XmlNode tempMasterNode, tempNode, tempChildNode;
            tempMasterNode = CreateChildNode(doc, "Users", "");
            doc.AppendChild(tempMasterNode);
            //tempNode = CreateChildNode(doc,tempMasterNode,"Person", "");
            // doc.AppendChild(tempNode);
 
            string uId = oParam;
            string displayName;
            string UserID;
            string telephoneNumber = "";
            string mgr = "";
            string dept = "";
            string email = "";
            string ploc = "";
            string title = "";
            string country = "";
            string domain = "";
            string group = "";
            bool isUserID = false;
            bool isTelephone = false;
            bool isName = false;
            int userinput = 0;
 
            //string Path = "LDAP://DC=XX,DC=XXX,DC=com";
           
            System.DirectoryServices.DirectoryEntry objDE = new System.DirectoryServices.DirectoryEntry((Path));
            DirectorySearcher objSearcher = new DirectorySearcher(objDE);
            objSearcher.SearchScope = SearchScope.Subtree;
            objSearcher.PropertiesToLoad.Add("displayName");
            objSearcher.PropertiesToLoad.Add("sAMAccountName");
            objSearcher.PropertiesToLoad.Add("telephoneNumber");
            objSearcher.PropertiesToLoad.Add("manager");
            objSearcher.PropertiesToLoad.Add("departmentNumber");
            objSearcher.PropertiesToLoad.Add("mail");
            objSearcher.PropertiesToLoad.Add("physicalDeliveryOfficeName");
            objSearcher.PropertiesToLoad.Add("Title");
            objSearcher.PropertiesToLoad.Add("co");
            objSearcher.PropertiesToLoad.Add("canonicalName");
            objSearcher.PropertiesToLoad.Add("memberOf");
 
            isUserID = IsAlphaNumeric(oParam);
            isTelephone = IsWholeNumber(oParam);
            isName = IsAlpha(oParam);
            if (isTelephone)
                userinput = 1;
            else
                if (isName)
                    userinput = 2;
                else
                    if (isUserID)
                        userinput = 3;
                    else
                        userinput = 4;
            switch (userinput)
            {
                case 1:
                    //objSearcher.Filter = "(&(objectClass=user)(|(sAMAccountName=" + oParam + "*)(telephoneNumber=" + oParam + "*)))";
                    objSearcher.Filter = "(&(objectClass=user)(telephoneNumber=*" + oParam + "))";
                    break;
                case 2:
                    objSearcher.Filter = "(&(objectClass=user)(|(displayName=" + oParam + "*)(sn=" + oParam + "*)))";
                    break;
                case 3:
 
                    objSearcher.Filter = "(&(objectClass=user)(sAMAccountName=" + oParam + "*))";
                    break;
                case 4:
                    objSearcher.Filter = "(&(objectClass=user)(|(sAMAccountName=" + oParam + "*)(SN=" + oParam + "*)(GivenName=" + oParam + "*)(cn=" + oParam + "*)(telephoneNumber=" + oParam + "*)))";
                    break;
            }
 
 
 
            ///'''''''''''''''''''''''filter'''''''''''''''''''''''''''
            // objSearcher.Filter = "(&(objectClass=user)(|(sAMAccountName=" + oParam + "*)(SN=" + oParam + "*)(GivenName=" + oParam + "*)(cn=" + oParam + "*)(telephoneNumber=" + oParam + "*)))";
 
            ///''''''''''''''''''''''filter'''''''''''''''''''''''''''' 
            try
            {
               foreach (SearchResult objResult in objSearcher.FindAll())
                {
          tempNode = CreateChildNode(doc, tempMasterNode, "Person", "");
 
                    //*************************DisplayName**************
       displayName = objResult.Properties["displayName"][0].ToString();
                    tempChildNode = CreateChildNode(doc, tempNode, "displayName", "");
                    tempChildNode.InnerXml = displayName;
                    //*************************DisplayName**************
                    //*************************UserID************              
 UserID = objResult.Properties["sAMAccountName"][0].ToString();
           tempChildNode = CreateChildNode(doc, tempNode, "userid", "");
                    tempChildNode.InnerXml = UserID;
                    //*************************UserID*******************
                    
                    
                    
                   
             //************************Group****************************
            for(int i=0;i<(objResult.Properties["memberOf"].Count);i++)
                    {
                       if (objResult.Properties["memberOf"].Count > 0)
                       {
                group = objResult.Properties["memberOf"][i].ToString();
                       }
 
           tempChildNode = CreateChildNode(doc, tempNode, "Group", "");
 
                    tempChildNode.InnerXml = group;
                    }
                
 
 
                    //************************Group*********************
                    
 
                                 }
            }
            catch (Exception e)
            {
 
      tempChildNode = CreateChildNode(doc, tempMasterNode, "error", "");
                tempChildNode.InnerXml = e.Message;
            }
            return doc;
        }
    
    
    
    
    }

Open in new window

0
anipeddi
Asked:
anipeddi
  • 3
  • 2
1 Solution
 
Henrik JohanssonSystems engineerCommented:
memberOf doesn't return primary group.
Compare property primaryGroupID for the user with property PrimaryGroupToken for the group to get the primary group information.
0
 
anipeddiAuthor Commented:
Can you provide code in C# for the logic you have specified
0
 
Henrik JohanssonSystems engineerCommented:
Sorry, C# isn't my strong side.
You nead as said to check the primaryGroupID of the user to find out the primary group.
For the user-query, add the following
            objSearcher.PropertiesToLoad.Add("primaryGroupID");

When having the user object, make a new search with a changed LDAP-criteria to find the matching group for extracted primaryGroupID
            objGroupSearcher.Filter="(PrimaryGroupToken="+objSearcher.Properties("primaryGroupID") +")"
0
 
anipeddiAuthor Commented:
Thanks for your solution, it works great!
I got an other problem, I need to search AD across multiple domains(entire forest or need to specify 2 or more domains)
 ->currently my query string is
   string Path = "LDAP://DC=MyDomain,DC=MyCompany,DC=com";
Could you help my how to specify multiple domains in the query string.
I tried to put 2 domains in the query like this, but it does not work.
 string Path = "LDAP://DC=MyDomain1,DC=MyDomain2,DC=MyCompany,DC=com";
0
 
Henrik JohanssonSystems engineerCommented:
The LDAP-path in the extra OT-question will give you the domain MyDomain1.MyDomain2.MyCompany.com. If you want to access multiple domains, you nead to loop through a list/array of LDAP-domains and make a connection to each of them.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now