Skip to main content

Programming AD with C#.NET – part 3

So far we have managed to exclude System.DirectoryServices because of our original issues, and System.DirectoryServices.AccountManagement because of performance issues. What is left for us now is System.DirectoryServices.Protocols, and that is the namespace of our choice.

Generally the System.DirectoryServices.Protocols is pretty similar to System.DirectoryServices, so it is not a big deal to rebuild our existing classes to a newer version. But there are always some small obsacles that need to be conquered. A very good guide to get started with these classes is written by Ethan Wilansky and published on MSDN, Introduction to System.DirectoryServices.Protocols.

An small issue is that you always have to know if an attribute exists before you try to remove it. The same thing applies when an attribute is saved, you must know if it is a new attribute to be created or an existing attribute that should be updated. If an incorrect action is taken a DirectoryOperationException will be thrown. A simple solution for this problem is to add a PermissiveModifyControl to the request. This will make sure that add, edit and remove events is handled nicely without throwing any exceptions.

Paging a search result is another thing that could be a little tricky. With System.DirectoryServices you only had to set the PageSize on a DirectorySearcher and the paging was automatically handled. With System.DirectoryServices.Protocols we have got to deal with the paging ourselves. There are a lot more information about this in the article mention above, Introduction to System.DirectoryServices.Protocols.

One third little quirk I had was when creating user accounts.We need to be able to set the password, and with System.DirectoryServices.Protocols it is possible to modify the value unicodePwd. However there are a couple of things to keep in mind.:
  • A 128 bit encrypted channel must be used.
  • The password must be a byte array containing the password surrounded by quotation marks.
Here is a simple code sample that meets both of these demands:

LdapDirectoryIdentifier identifier = new LdapDirectoryIdentifier("server");
NetworkCredential credential = new NetworkCredential("user", "password", "domain");
using(LdapConnection connection = new LdapConnection(identifier, credential))
{
    connection.SessionOptions.Signed = true;
    connection.SessionOptions.Sealed = true;
    DirectoryAttribute[] attributes = new DirectoryAttribute[] {
        new DirectoryAttribute("objectClass", "user"),
        new DirectoryAttribute("userPrincipalName", "newAdAccount@domain.com"),
        new DirectoryAttribute("samAccountName", "newAdAccount"),
        new DirectoryAttribute("unicodePwd", Encoding.Unicode.GetBytes("\"passw0rd\""))
    };
    AddRequest request = new AddRequest("CN=newAdAccount,OU=Test,DN=domain,DN=com", attributes);
    connection.SendRequest(request);
}
Labels:

Comments

Post a Comment

Popular posts from this blog

Binding Enum with DescriptionAttribute in WPF

Binding an enumeration to a ComboBox can be done in several ways. In most cases you don't want to display the value itself, but a more user friendly description. One common approach is to use the DescriptionAttribute on the Enum values to supply a description for each value.  This is all possible in a very MVVM friendly way. First step is to add the  DescriptionAttribute  to the values of the enumeration. public enum MyValues { [Description("First value")] First, [Description("Second value")] Second } To retrieve the description from the enum we use a simple extension method. This method returns the value of the DescriptionAttribute if it exists, otherwise the string representation of the enum value is returned. public static string GetDescription(this Enum value) { var fieldInfo = value.GetType().GetField(value.ToString()); var attribute = fieldInfo.GetCustomAttributes(typeof(DescriptionAttribute), false).FirstOrDefault() as
2 comments
Read more

Programming AD with C#.NET – part 4

Our transition to the  System.DirectoryServices.Protocols  has in the whole gone very smooth, but there have been some issues with one environment that contains subdomains. Most things are working fine, but writing to a subdomain does not work in the same way as it did before. What is generally bad with the  System.DirectoryServices.Protocols is the documentation, which is practically non-existent. But most things can  be figured out anyway since most classes just are wrappers for the wldap32.dll, which in turn is way better documented. I would like to have as little bindings to a specific server as possible but still be able to access the domain. In the  LdapConnection  it is possible to set the identifier to null and use the executing computer as a starting point to find a domain controller. But sometimes I must know that I am using a Global Catalog, and with more and more RODC in the environment I sometimes must know that I am working against a writeable domain controller.
Post a Comment
Read more

User.Identity returns old login name after name change

When a person gets married or makes a name change for some other reason this usually means that the login name for the Active Directory-account changes as well. This is rarely a problem, but it turned out to cause some issues on our web server, where the  User.Identity  property was still returning the old login name. The user logged on with the new login name, but was identified by the web application as the old login name. The reason this occurs is because the  User.Identity  property relies on the  LsaLookupSids  method to convert the user SID to a login name. The method first calls the local  LSA-cache , which is not synchronized with the Active Directory. For this purpose a simple reboot of the web server to clear the  LSA-cache  propably would have sufficed. But since we didn't want to take the application offline rebooting was not an option. Instead, it is possible to set the registry value  LsaLookupCacheMaxSize in HKLM\SYSTEM\CurrentControlSet\Control\Lsa. If this val
Post a Comment
Read more