Question

I have a web app (.NET 3.5) which is sending notifications by email to users. In order to do this, I search Active Directory to find each person’s email.

At the moment, I am hardcoding my own username and password like so in order to search AD:

    Dim entry As New DirectoryEntry("LDAP://companyad", "myUsername", "myPassword", AuthenticationTypes.Secure)
    Dim srch As New DirectorySearcher(entry)
    srch.Filter = [String].Format("(&(objectClass=person)(sAMAccountName={0}))", "someOtherUsername")
    Dim result As SearchResult = srch.FindOne()

Now, obviously, this is not ideal and I don’t want those credentials hardcoded. My web app is using Windows Authentication. It also uses impersonation (as the logged in user) to access files and SQL Server. Is there also a way for me to “impersonate” the logged in user in order to search AD?

EDIT 1

I thought I’d better explain why I chose this answer. The problem turned out to not be the multi-hop issue or kerberos as it seems I have set these up correctly.

I had recently changed my app to only allow access to a certain group through the web.config settings. I had previously been only allowing access to myself. I set up the group and added myself to it. I then removed the hardcoded credentials and attempted to run the app WITHOUT RESTARTING my computer.

According to my network admin, I would not be logged on under that new group until I restarted my computer which I think is what was causing my problem. So, Preet’s answer is actually the most accurate as I just needed to pass the LDAP path to DirectoryEntry.

EDIT 2

I also needed to register a Service Principal Name.

I ran this:

setspn -A HTTP/[dns name of the site] [machine name]

on my development machine.

Thanks to everyone else for their answers.

Answer 1

Doesn’t

Dim entry As New DirectoryEntry("LDAP://companyad")

work?