Arslan306
asked on
How to get Get usergroup of user from LDAP active directory
Hi All,
I want to check usergroup of user on LDAP active directory or you can say I want to check user is member of these groups on LDAP Active Directory. I will send user name to that and find my user "XYZ" is member of these groups. Can You Please provide me Code snippet for my .net ASP Application. Thanks in Advance
I want to check usergroup of user on LDAP active directory or you can say I want to check user is member of these groups on LDAP Active Directory. I will send user name to that and find my user "XYZ" is member of these groups. Can You Please provide me Code snippet for my .net ASP Application. Thanks in Advance
here a vbs example : http://www.rlmueller.net/Programs/IsMember1.txt
and here a vb.net example : http://stackoverflow.com/questions/1032351/how-to-write-ldap-query-to-test-if-user-is-member-of-a-group
and here a vb.net example : http://stackoverflow.com/questions/1032351/how-to-write-ldap-query-to-test-if-user-is-member-of-a-group
ASKER
Hi Madgino,
I have checked Your Code snippet, Its First Part is working fine But at this Line Code gives exception
deSearcher.PropertiesToLoa d.Add("mem berOf");
SearchResult sResult = deSearcher.FindOne(); \\ Here Exception Comes
Exception Message is "Bad UserName And Password Or Unknown Error"
I Have checked multiple time With My Username And Password And Domain Name And Group Name.
All are Working Perfect. There is No Error in That. Please Test That On Your Side Too. Thanks Or Purpose Any Other Solution.
Thanks
I have checked Your Code snippet, Its First Part is working fine But at this Line Code gives exception
deSearcher.PropertiesToLoa
SearchResult sResult = deSearcher.FindOne(); \\ Here Exception Comes
Exception Message is "Bad UserName And Password Or Unknown Error"
I Have checked multiple time With My Username And Password And Domain Name And Group Name.
All are Working Perfect. There is No Error in That. Please Test That On Your Side Too. Thanks Or Purpose Any Other Solution.
Thanks
Basics, form an LDAP standpoint, looking at AD, members of groups are expressed as values for the "member" attribute by the fully distinguished name of the members.
Looking at a group, the member attribute might show:
member: CN=Administrator,CN=Users, DC=mad,DC= willeke,DC =com
member: CN=jim,CN=Users,DC=mad,DC= willeke,DC =com
In AD, there is a server derived attribute, meaning the server puts the value there and you should no mofify the values, "memberOf" that is on the user entry that indicates the fully distinghushed name of any groups the entry is a member of.
The code referenced by madgino is looks at the "memberOf" values. (Which should work fine)
The problem, I believe, you are having is in locating the entry.
The code uses this line to find the user:
deSearcher.Filter = "sAMAccountName=" + Username.Replace("@" + LDAPServer, "");
The samAccountName does NOT contain a @ sign. The userPrincipalname does.
Try changing this line to:
deSearcher.Filter = "sAMAccountName="+ Username;
-jim
Looking at a group, the member attribute might show:
member: CN=Administrator,CN=Users,
member: CN=jim,CN=Users,DC=mad,DC=
In AD, there is a server derived attribute, meaning the server puts the value there and you should no mofify the values, "memberOf" that is on the user entry that indicates the fully distinghushed name of any groups the entry is a member of.
The code referenced by madgino is looks at the "memberOf" values. (Which should work fine)
The problem, I believe, you are having is in locating the entry.
The code uses this line to find the user:
deSearcher.Filter = "sAMAccountName=" + Username.Replace("@" + LDAPServer, "");
The samAccountName does NOT contain a @ sign. The userPrincipalname does.
Try changing this line to:
deSearcher.Filter = "sAMAccountName="+ Username;
-jim
ASKER
Still Its Not Working For Me. Can You Please Specify Any Other Solution
Hi, sorry for the delay but I wanted to test it too before responding you. The below code is working fine for me, you just have to be sure when you're searching that you're using a property that exists in your LDAP.
For example the property sAMAccountName doesn't exists in my LDAP and the search was failing on FindOne method. After I replaced with uid it went fine.
For example the property sAMAccountName doesn't exists in my LDAP and the search was failing on FindOne method. After I replaced with uid it went fine.
DirectoryEntry root = new DirectoryEntry("LDAP://myserver/dc=v1,dc=v2");
root.AuthenticationType = AuthenticationTypes.None;
DirectorySearcher searcher = new DirectorySearcher(root, string.Format("(uid={0})", "username"));
SearchResult sr = searcher.FindOne();
if (!(sr == null))
{
int groupCount = sr.Properties["memberOf"].Count - 1;
}
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Its Worked For Me
http://www.codekeep.net/snippets/bf0afe36-4d3e-4914-b0d7-f8137d46a15c.aspx