Question

I am writing a standalone application that needs to, given a AD account name, figure out if the user is a member of a particular group. I am writing the application in .NET (C#). The structure in AD looks like this:

• Organization
  • Team 1
    • David (user)
• Groups
  • Application A
    • Team 1 (group from above)

Just listing the memberships for David will not show that he is a member of the Application A group.

I understand from Microsoft’s documentation that (using the principals) I could simply use the IsInRole call, but I cannot find any case that doesn’t require David to be logged on to the machine or running the application performing the check. I think my limited understanding of the security model also comes into play here.

Could someone please point me in the right direction? What I am looking for is hints on how to solve above (references, tips, snippets) in C#, without depending on David having to run any application.

Let me know if anything can be clarified.

Answer 1

Add a reference to DirectoryServices.AccountManagement

Then add a using statement:

using System.DirectoryServices.AccountManagement;

Then in your main procedure (or somewhere else, where required, call the Procedure IsMember:

string userName = "David";
string GroupName = "Team 1";
bool test = IsMember(userName, GroupName);

---

    public static bool IsMember(string UserName, string GroupName)
    {
        try
        {
            UserPrincipal user = UserPrincipal.FindByIdentity(
                new PrincipalContext(ContextType.Domain),
                UserName);

            foreach (Principal result in user.GetAuthorizationGroups())
            {
                if (string.Compare(result.Name, GroupName, true) == 0)
                    return true;
            }
            return false;
        }
        catch (Exception E)
        { 
            throw E; 
        }
    }

If David is in Team 1, the procedure will return true, otherwise false.