active directory - Determine usergroups/claims of user given LDAP server details in C# -

active directory - Determine usergroups/claims of user given LDAP server details in C# -

we have test active directory ldap server. have user names , passwords. determine claims/user groups of particular user, whilst logged domain. can done c# code? presume have utilize system.directoryservices.dll

if can utilize .net 3.5 of higher, seek system.directoryservices.accountmanagement.dll assembly. provides system.directoryservices.accountmanagement namespace , principal-based classes, such userprincipal , groupprincipal. represent higher level of abstraction , easier use.

for example, connect ldap server in domain (get principal context in terms of abstraction) need create instance of principalcontext class this constructor:

principalcontext anotherdomaincontext = new principalcontext(contexttype.domain, domaindnsname, rootou, contextoptions.simplebind, queryusername, queryuserpassword);

rootou "dc=company,dc=com", hence domaindnsname "company.com" or "ldapserver.company.com". if have serveral domains in advertisement forest seek connect global catalog (domaindnsname = "ldapserver.company.com:3268"). queryusername , queryuserpassword plain strings username , password used connect ldap server. username may include domain name, example:

string queryusername = @"company\username";

once connected ldap server can search users:

userprincipal user = userprincipal.findbyidentity(anotherdomaincontext , identitytype.samaccountname, samaccountname);

where supply samaccountname , context (connection).

with instance of userprincipal @ hands gain access its properties , methods. example, security groups user:

principalsearchresult<principal> searchresults = user.getgroups(); list<groupprincipal> groupslist = searchresults.select(result => result groupprincipal). where(group => (group != null) && (group.issecuritygroup.hasvalue) && (group.issecuritygroup.value))

note getgroups returns groups user belongs directrly. user groups including nested, phone call getauthorizationgroups. also, can avoid using linq, it's filtering security groups getgroups.

with groupprincipal can check name property, or members collecion.

c# active-directory ldap