Solved

LDAP Problem with Memberof information

Posted on 2008-09-30
5
1,049 Views
Last Modified: 2013-12-24
I am developing an asp.net web service which interact with Active Directory(through LDAP) and returns user information.

The web service is working perfect every thing except the memberof information.It is not returning the MemberOf(group name) information for all the users except me,Ie is if query the AD from my system using my UserID it returns my MemberOf info but if use any other person ID it returns all the information except memberOf.I think it is a security issue,I have seen a post in experts-exchange previously,
http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_23577274.html
 it suggests to use impersonation to solve this problem, but it is an classic asp application, Can any one tell me how to solve my problem in asp.net.

Thanks
[WebMethod]

    public XmlDocument GetADgroupsForPerson(string oParam)

    {

 

        {

            XmlDocument doc = new XmlDocument();

            XmlNode tempMasterNode, tempNode, tempChildNode;

            tempMasterNode = CreateChildNode(doc, "Users", "");

            doc.AppendChild(tempMasterNode);

            //tempNode = CreateChildNode(doc,tempMasterNode,"Person", "");

            // doc.AppendChild(tempNode);

 

            string uId = oParam;

            string displayName;

            string UserID;

            string telephoneNumber = "";

            string mgr = "";

            string dept = "";

            string email = "";

            string ploc = "";

            string title = "";

            string country = "";

            string domain = "";

            string group = "";

            bool isUserID = false;

            bool isTelephone = false;

            bool isName = false;

            int userinput = 0;

 

            //string Path = "LDAP://DC=XX,DC=XXX,DC=com";

           

            System.DirectoryServices.DirectoryEntry objDE = new System.DirectoryServices.DirectoryEntry((Path));

            DirectorySearcher objSearcher = new DirectorySearcher(objDE);

            objSearcher.SearchScope = SearchScope.Subtree;

            objSearcher.PropertiesToLoad.Add("displayName");

            objSearcher.PropertiesToLoad.Add("sAMAccountName");

            objSearcher.PropertiesToLoad.Add("telephoneNumber");

            objSearcher.PropertiesToLoad.Add("manager");

            objSearcher.PropertiesToLoad.Add("departmentNumber");

            objSearcher.PropertiesToLoad.Add("mail");

            objSearcher.PropertiesToLoad.Add("physicalDeliveryOfficeName");

            objSearcher.PropertiesToLoad.Add("Title");

            objSearcher.PropertiesToLoad.Add("co");

            objSearcher.PropertiesToLoad.Add("canonicalName");

            objSearcher.PropertiesToLoad.Add("memberOf");

 

            isUserID = IsAlphaNumeric(oParam);

            isTelephone = IsWholeNumber(oParam);

            isName = IsAlpha(oParam);

            if (isTelephone)

                userinput = 1;

            else

                if (isName)

                    userinput = 2;

                else

                    if (isUserID)

                        userinput = 3;

                    else

                        userinput = 4;

            switch (userinput)

            {

                case 1:

                    //objSearcher.Filter = "(&(objectClass=user)(|(sAMAccountName=" + oParam + "*)(telephoneNumber=" + oParam + "*)))";

                    objSearcher.Filter = "(&(objectClass=user)(telephoneNumber=*" + oParam + "))";

                    break;

                case 2:

                    objSearcher.Filter = "(&(objectClass=user)(|(displayName=" + oParam + "*)(sn=" + oParam + "*)))";

                    break;

                case 3:

 

                    objSearcher.Filter = "(&(objectClass=user)(sAMAccountName=" + oParam + "*))";

                    break;

                case 4:

                    objSearcher.Filter = "(&(objectClass=user)(|(sAMAccountName=" + oParam + "*)(SN=" + oParam + "*)(GivenName=" + oParam + "*)(cn=" + oParam + "*)(telephoneNumber=" + oParam + "*)))";

                    break;

            }

 

 

 

            ///'''''''''''''''''''''''filter'''''''''''''''''''''''''''

            // objSearcher.Filter = "(&(objectClass=user)(|(sAMAccountName=" + oParam + "*)(SN=" + oParam + "*)(GivenName=" + oParam + "*)(cn=" + oParam + "*)(telephoneNumber=" + oParam + "*)))";

 

            ///''''''''''''''''''''''filter'''''''''''''''''''''''''''' 

            try

            {

               foreach (SearchResult objResult in objSearcher.FindAll())

                {

          tempNode = CreateChildNode(doc, tempMasterNode, "Person", "");

 

                    //*************************DisplayName**************

       displayName = objResult.Properties["displayName"][0].ToString();

                    tempChildNode = CreateChildNode(doc, tempNode, "displayName", "");

                    tempChildNode.InnerXml = displayName;

                    //*************************DisplayName**************

                    //*************************UserID************              

 UserID = objResult.Properties["sAMAccountName"][0].ToString();

           tempChildNode = CreateChildNode(doc, tempNode, "userid", "");

                    tempChildNode.InnerXml = UserID;

                    //*************************UserID*******************

                    

                    

                    

                   

             //************************Group****************************

            for(int i=0;i<(objResult.Properties["memberOf"].Count);i++)

                    {

                       if (objResult.Properties["memberOf"].Count > 0)

                       {

                group = objResult.Properties["memberOf"][i].ToString();

                       }

 

           tempChildNode = CreateChildNode(doc, tempNode, "Group", "");

 

                    tempChildNode.InnerXml = group;

                    }

                

 

 

                    //************************Group*********************

                    

 

                                 }

            }

            catch (Exception e)

            {

 

      tempChildNode = CreateChildNode(doc, tempMasterNode, "error", "");

                tempChildNode.InnerXml = e.Message;

            }

            return doc;

        }

    

    

    

    

    }

Open in new window

0
Comment
Question by:anipeddi
  • 3
  • 2
5 Comments
 
LVL 31

Expert Comment

by:Henrik Johansson
Comment Utility
memberOf doesn't return primary group.
Compare property primaryGroupID for the user with property PrimaryGroupToken for the group to get the primary group information.
0
 
LVL 4

Author Comment

by:anipeddi
Comment Utility
Can you provide code in C# for the logic you have specified
0
 
LVL 31

Accepted Solution

by:
Henrik Johansson earned 500 total points
Comment Utility
Sorry, C# isn't my strong side.
You nead as said to check the primaryGroupID of the user to find out the primary group.
For the user-query, add the following
            objSearcher.PropertiesToLoad.Add("primaryGroupID");

When having the user object, make a new search with a changed LDAP-criteria to find the matching group for extracted primaryGroupID
            objGroupSearcher.Filter="(PrimaryGroupToken="+objSearcher.Properties("primaryGroupID") +")"
0
 
LVL 4

Author Comment

by:anipeddi
Comment Utility
Thanks for your solution, it works great!
I got an other problem, I need to search AD across multiple domains(entire forest or need to specify 2 or more domains)
 ->currently my query string is
   string Path = "LDAP://DC=MyDomain,DC=MyCompany,DC=com";
Could you help my how to specify multiple domains in the query string.
I tried to put 2 domains in the query like this, but it does not work.
 string Path = "LDAP://DC=MyDomain1,DC=MyDomain2,DC=MyCompany,DC=com";
0
 
LVL 31

Expert Comment

by:Henrik Johansson
Comment Utility
The LDAP-path in the extra OT-question will give you the domain MyDomain1.MyDomain2.MyCompany.com. If you want to access multiple domains, you nead to loop through a list/array of LDAP-domains and make a connection to each of them.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

International Data Corporation (IDC) prognosticates that before the current the year gets over disbursing on IT framework products to be sent in cloud environs will be $37.1B.
Many companies are looking to get out of the datacenter business and to services like Microsoft Azure to provide Infrastructure as a Service (IaaS) solutions for legacy client server workloads, rather than continuing to make capital investments in h…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now