This is an action that often is required when you want to make sure a user account may access some resource only if they are part of some AD (OU) group. There are other ways to do this – if fact it is a lot easier if you use newer versions on the .Net framework (like 3.5 and later) but I had to create something that will still work with the 2.0 framework – thanks to some older 2003 servers that I have to manage.<\/p>\n
I’m not going to explain too much details on how it works internally – the simple explanation is that I take the user account and loop through the list of groups the user is a ‘memberOf’. One tricky thing is to also cater for cross domain accounts\/groups – like when you have a dev domain that also have groups but the user account is part of the live domain – or some combination like it.<\/p>\n
The solution is a single helper class with one public method – IsUserInGroup(string userName, string groupName). Creating an instance of a class with one method is a bit of a waste so the class is a simple static class.<\/p>\n
public static class DirectoryServicesHelper<\/span>
\n{<\/p>\nprivate static bool<\/span> useDomainName = false;<\/p>\n
public static bool<\/span> IsUserInGroup(string <\/span>userName, string <\/span>groupName)
\n{<\/p>\nuseDomainName = userName.Contains(“\\\\”) || groupName.Contains(“\\\\”);
\nList<\/span><string<\/span>> userGroups = GetGroupsForUser(userName);
\nif <\/span>(userGroups.Contains(groupName.ToLower()))<\/p>\nreturn true<\/span>;<\/p>\n
return false<\/span>;<\/p>\n
}<\/p>\n<\/blockquote>\n
The ‘useDomainName’ variable is there simply to indicate to other methods if they must cater for domain level details or not. Most of the rest of the code is inside the private ‘GetGroupsForUser’ method.<\/p>\n
private static List<\/span><string<\/span>> GetGroupsForUser(string <\/span>pstrUser)
\n{<\/p>\nList<\/span><string<\/span>> lstGroups = new List<\/span><string<\/span>>();<\/p>\n
string <\/span>domain = System.DirectoryServices.ActiveDirectory.Domain<\/span>.GetCurrentDomain().Name;
\nDirectoryEntry <\/span>rootEntry;
\nif <\/span>(useDomainName && pstrUser.Contains(“\\\\”))
\n{<\/p>\ndomain = pstrUser.Substring(0, pstrUser.IndexOf(“\\\\”));
\npstrUser = pstrUser.Substring(pstrUser.IndexOf(“\\\\”) + 1);<\/p>\n}
\nrootEntry = new DirectoryEntry<\/span>(“LDAP:\/\/” + domain);<\/p>\nusing <\/span>(DirectorySearcher <\/span>searcher = new DirectorySearcher<\/span>(rootEntry, “objectCategory=User”))
\n{<\/p>\nsearcher.Filter = string<\/span>.Format(“(SAMAccountName={0})”, pstrUser);
\nSearchResult <\/span>objSR = searcher.FindOne();
\nif <\/span>(objSR != null<\/span>)
\n{<\/p>\nusing <\/span>(DirectoryEntry <\/span>objUser = new DirectoryEntry<\/span>(objSR.Path))
\n{<\/p>\nSystem.DirectoryServices.PropertyCollection <\/span>colProperties = objUser.Properties;
\nPropertyValueCollection <\/span>colPropertyValues = colProperties[“memberOf”];
\nforeach <\/span>(string <\/span>strGroup in colPropertyValues)
\n{<\/p>\nlstGroups.Add(GetSAMAccountName(strGroup).ToLower());<\/p>\n
}<\/p>\n
}<\/p>\n
}<\/p>\n
}
\nreturn <\/span>lstGroups;<\/p>\n}<\/p>\n
private static string<\/span> GetDomainNameFromDE(DirectoryEntry <\/span>entry)
\n{<\/p>\nif <\/span>(entry == null<\/span>)<\/p>\n
return <\/span>“”;<\/p>\n
else<\/span>
\n{<\/p>\nif <\/span>(entry.SchemaClassName == “domainDNS”)<\/p>\n
return <\/span>entry.Properties[“Name”].Value.ToString();<\/p>\n
else if <\/span>(entry.Parent != null<\/span>)<\/p>\n
return <\/span>GetDomainNameFromDE(entry.Parent);<\/p>\n
else<\/span><\/p>\n
return <\/span>“”;<\/p>\n
}<\/p>\n
}<\/p>\n
private static string<\/span> GetSAMAccountName(string <\/span>pstrPath)
\n{<\/p>\nDirectoryEntry <\/span>objADEntry = null<\/span>;
\nstring <\/span>output = “”;
\nobjADEntry = new DirectoryEntry<\/span>(“LDAP:\/\/” + pstrPath);
\nif <\/span>(objADEntry != null<\/span>)
\n{<\/p>\nif <\/span>(useDomainName)<\/p>\n
output = GetDomainNameFromDE(objADEntry) + “\\\\” + objADEntry.Properties[“SAMAccountName”].Value.ToString();<\/p>\n
else<\/span><\/p>\n
output = objADEntry.Properties[“SAMAccountName”].Value.ToString();<\/p>\n
}
\nreturn <\/span>output;<\/p>\n}<\/p><\/blockquote>\n
Summary<\/span><\/h2>\n
I’ve excluded any error checking to make the code simpler to read. For a real utility class you need to add it since AD is an unmanaged resource (as far as .Net goes) and it can throw COM+ errors as well.<\/p>\n
With this little helper class you can simply pass it a user and group name and it will return a true or false if the user is part of the group. I’ve tested it with no domain details, partial domain details, mixed domains etc. Hopefully it can help someone else as well.<\/p>\n","protected":false},"excerpt":{"rendered":"
This is an action that often is required when you want to make sure a user account may access some resource only if they are part of some AD (OU) group. There are other ways to do this – if …<\/p>\n