c# - Get all groups for a user using LDAP -
i've tried load groups user ldap.
currently i'm testing on our local ad. following code can load groups of given user:
public ienumerable<string> getusergroups( string username ) { using ( var domaincontext = new principalcontext( contexttype.domain, name ) ) { var user = userprincipal.findbyidentity( domaincontext, username ); return user.getauthorizationgroups().select( x => x.name} ).tolist(); } }
but fail same result using ldap.
code using ldap:
public ienumerable<string> getusergroups1(string username) { //returns container name of given user var containername = getusercontainername(username); var groups = new list<string>(); if (containername == null) return groups; var entry = new directoryentry(string.format("ldap://{0}", "dc=example,dc=com")); var searcher = new directorysearcher(entry) { filter = string.format("(member:{0}:=cn={1},{2},{3})", "1.2.840.113556.1.4.1941", containername, "cn=users", "dc=example,dc=com"), searchscope = searchscope.subtree }; var result = searcher.findall(); (var = 0; < result.count; i++) { var path = result[i].path; var startindex = path.indexof("cn=", stringcomparison.ordinal) + 3; groups.add(path.substring(startindex, path.indexof(",", startindex + 1, stringcomparison.ordinal) - startindex)); } return groups; }
how can groups user using ldap?
my first advice should split method in sort of having better overview:
- get user.
you use that:
/// <summary> /// return user user name /// </summary> /// <param name="username_">username base search on</param> /// <returns> /// user manager or null if not found /// </returns> public static directoryentry searchforuser(string username_) { directoryentry de = null; directorysearcher directorysearcher = null; domain domain = null; try { if (string.isnullorempty(username_)) return null; string username = username_.startswith("cn=") ? username_.replace("cn=", string.empty) : username_; de = new directoryentry("ldap://" + domain.getcurrentdomain().name); directorysearcher = new directorysearcher(de); directorysearcher.filter = string.format("(&(objectclass=person)(objectcategory=user)(samaccountname={0}))", username); searchresult searchresult = directorysearcher.findone(); return searchresult != null ? searchresult_.getdirectoryentry() : null; } { if (de != null) de.dispose(); if (directorysearcher != null) directorysearcher.dispose(); if (domain != null) domain.dispose(); } }
this way, can valid ldap path, domain name, domain
- get groups.
use second method , groups.
/// <summary> ///returns list groups user member of. /// </summary> /// <remarks>the members in returned list instances of group.</remarks> /// <returns>groups user member of.</returns> public list<directoryentry> getgroups() { return (from object o in entry.properties["memberof"] select new directoryentry(path) direntry direntry.schemaclassname == "group" select {directoryentry = direntry}).tolist(); }
where path ou path (root, or not).
the biggest challenge managing , building ldap path.
i hope helped.
Comments
Post a Comment