Properly using directorysearcher to find a user in an AD Group

[Jim in Arizona]

I'm trying to do a check to see if a specific active directory user account
exists in active directory AND a specific group. I can't seem to get the
filter down right.

I can do this to find a matching name in active directory:

=============== =============== =============== ===
Dim oroot As DirectoryEntry = New DirectoryEntry( "LDAP://my.domain.local ")
Dim osearcher As DirectorySearch er = New DirectorySearch er(oroot)
Dim oresult As SearchResultCol lection
Dim result As SearchResult

osearcher.Filte r = "(&(sAMAccountN ame=jsmith))"
oresult = osearcher.FindA ll

For Each result In oresult
If Not result.GetDirec toryEntry.Prope rties("SAMAccou ntName").Value Is
Nothing Then
Response.Write( result.GetDirec toryEntry.Prope rties("SAMAccou ntName").Value
& "<br />")
End If
Next

'This results in "jsmith' being printed to the screen (if jsmith exists in
active directory)
=============== =============== =============== ===

I can do this to find a specific group name:

=============== =============== =============== ===
Dim oroot As DirectoryEntry = New DirectoryEntry( "LDAP://my.domain.local ")
Dim osearcher As DirectorySearch er = New DirectorySearch er(oroot)
Dim oresult As SearchResultCol lection
Dim result As SearchResult

osearcher.Filte r = "(&(objectCateg ory=Group)(sAMA ccountName=Doma in Admins))"
oresult = osearcher.FindA ll

For Each result In oresult
If Not result.GetDirec toryEntry.Prope rties("SAMAccou ntName").Value Is
Nothing Then
Response.Write( result.GetDirec toryEntry.Prope rties("SAMAccou ntName").Value
& "<br />")
End If
Next

'This results in "Domain Admins' being printed to the screen
=============== =============== =============== ===

I can even change the osearcher.filte r to just (sAMAccountName =Domain
Admins) and get the same result.

I'm trying to figure out how I can return the result (say, the user name
(samaccountname )) if the search paramater is both in AD and in the specific
group (or just the specific group).

My goal is to do a check like this (pseudocode):

=============== =============== =============== ===
Dim strUser as string = Request.ServerV ariables("AUTH_ USER")

Dim strADUser = osearcher.Filte r = "(&(sAMAccountN ame=" & strUser & "))"

If strUser = strADUser Then
Page.Redirect(T oSomePage)
Else
Page.Redirect(T oFailedPage)
End If
=============== =============== =============== ===

I Also need to check to see if they're in a specific group. I don't know how
I'd go about that. If, for instance, they're in the Sales group in AD, then
I could redirect them to the appropriate page. I could also, of course, keep
them out of other pages if they don't belong.

TIA,
Jim

[Alexey Smirnov]

Re: Properly using directorysearch er to find a user in an AD Group

On Mar 13, 6:57 pm, "Jim in Arizona" <tiltow...@hotm ail.comwrote:

I'm trying to do a check to see if a specific active directory user account
exists in active directory AND a specific group. I can't seem to get the
filter down right.
>
I can do this to find a matching name in active directory:
>
=============== =============== =============== ===
Dim oroot As DirectoryEntry = New DirectoryEntry( "LDAP://my.domain.local ")
Dim osearcher As DirectorySearch er = New DirectorySearch er(oroot)
Dim oresult As SearchResultCol lection
Dim result As SearchResult
>
osearcher.Filte r = "(&(sAMAccountN ame=jsmith))"
oresult = osearcher.FindA ll
>
For Each result In oresult
 If Not result.GetDirec toryEntry.Prope rties("SAMAccou ntName").Value Is
Nothing Then
  Response.Write( result.GetDirec toryEntry.Prope rties("SAMAccou ntName").Value
& "<br />")
 End If
Next
>
'This results in "jsmith' being printed to the screen (if jsmith exists in
active directory)
=============== =============== =============== ===
>
I can do this to find a specific group name:
>
=============== =============== =============== ===
Dim oroot As DirectoryEntry = New DirectoryEntry( "LDAP://my.domain.local ")
Dim osearcher As DirectorySearch er = New DirectorySearch er(oroot)
Dim oresult As SearchResultCol lection
Dim result As SearchResult
>
osearcher.Filte r = "(&(objectCateg ory=Group)(sAMA ccountName=Doma in Admins))"
oresult = osearcher.FindA ll
>
For Each result In oresult
 If Not result.GetDirec toryEntry.Prope rties("SAMAccou ntName").Value Is
Nothing Then
  Response.Write( result.GetDirec toryEntry.Prope rties("SAMAccou ntName").Value
& "<br />")
 End If
Next
>
'This results in "Domain Admins' being printed to the screen
=============== =============== =============== ===
>
I can even change the osearcher.filte r to just (sAMAccountName =Domain
Admins) and get the same result.
>
I'm trying to figure out how I can return the result (say, the user name
(samaccountname )) if the search paramater is both in AD and in the specific
group (or just the specific group).
>
My goal is to do a check like this (pseudocode):
>
=============== =============== =============== ===
Dim strUser as string = Request.ServerV ariables("AUTH_ USER")
>
Dim strADUser =  osearcher.Filte r = "(&(sAMAccountN ame=" & strUser& "))"
>
If strUser = strADUser Then
   Page.Redirect(T oSomePage)
Else
   Page.Redirect(T oFailedPage)
End If
=============== =============== =============== ===
>
I Also need to check to see if they're in a specific group. I don't know how
I'd go about that. If, for instance, they're in the Sales group in AD, then
I could redirect them to the appropriate page. I could also, of course, keep
them out of other pages if they don't belong.
>
TIA,
Jim

Domain Admins is an object with distinguishedNa me (a key to identify
this object). For example, it can look like this

"CN=Domain Admins,OU=Domai n Groups,DC=corp, DC=com"

As you can see, it defines the path to the root

corp.com
---- Domain Groups
---------- Domain Admins

So, to find the user you should call the following filter

(&(sAMAccountNa me=jsmith)(memb erOf=CN=Domain Admins,OU=Domai n
Groups,DC=corp, DC=com))

[Alexey Smirnov]

Re: Properly using directorysearch er to find a user in an AD Group

On Mar 13, 8:18 pm, "Jim in Arizona" <tiltow...@hotm ail.comwrote:

I'm hoping that if any of the searches were successful, they're username
(sAMAccountName ) would show up on the screen.
>
I'm not sure what to do to fix this. What am I doing wrong?
>

Jim, that's definitely because of the wrong memberOf value. I'm not
sure how your application is supposed to work but you can do
following:

1) Download and install LDAP browser (for example, like the one I'm
using from http://www.ldapbrowser.com/download.htm). Connect to your
domain and check what memberOf you have in reality

2) Find group's distinguishedNa me dynamically using a new
DirectorySearch er.

The search filter for finding group you already know:

"(&(objectCateg ory=group)(sAMA ccountName=" + groupName + "))"

where the group name is the name of the group you wanted to check
(e.g. "Domain Admins")

[pseudocode:]

Dim gsearcher As DirectorySearch er = New DirectorySearch er(oroot)
Dim gresult As SearchResultCol lection
Dim result As SearchResult

gsearcher.Filte r = "(&(objectCateg ory=group)(sAMA ccountName=" +
groupName + "))"
gresult = gsearcher.FindA ll

Dim dn As String

dn = gResult(0).Prop erties("disting uishedname")(0) .ToString

After that you can use this dn as a value for the final search

"(&(sAMAccountN ame=" & username & ")(memberOf =" & dn & "))"