Question

I have a web form sitting on an IIS instance on a server within our Active Directory domain.

When a user within the domain visits the web form, can I programatically capture their AD username, using something like..

Page.User.Identity.Name

Or is that just going to report the account name under which IIS is running?

Do I have to have the user specifically login in for me to look them up in AD?

If not, are there any other identifiers that I can capture, or is this not possible for security concerns?

Answer 1

You could use Integrated Windows Authentication (IWA) if your users will be in the same domain. By using that authentication method, then the identity should automatically be accessible in your application.

The ASP.NET site has a tutorial on setting up an MVC site with IWA. I know that you’re using WebForms, but the code is fairly self explanatory.

If you want to query additional information from active directory, just use something similar to the following (assuming you have .NET 3.5 or later where the System.DirectoryServices.AccountManagement library is available):

using (PrincipalContext context = new PrincipalContext(ContextType.Domain, "yourDomainName")) {
   using (UserPrincipal user = UserPrincipal.FindByIdentity(context, IdentityType.UserPrincipalName, theUserName)) {
      if (user != null) {
         //Do something with the user object.
      }
   }
}