Question

I need a bit of advice.
I’m extending a web app to integrate with AD member roles, and not too sure whether i can rely on User.IsInRole to have the member role information. Initial tests show me it does, but what is the difference between using this, and writing a class to return the user roles with DirectorySearcher/AccountManagement for example?

Is one solution better than the other?

It looks to me as though it achieves the same thing in this case. Am i right?

Thanks.

Answer 1

If you use active directory authorization Users.IsInRole checks if the user is member of the given group. It is not exactly the same as checking the groups that the user belongs to, because that only gives the direct memberships. Users.IsInRole also checks nested group membership. An example:

• UserA is a member of GroupA
• GroupA is a member of GroupB

Now if you check the direct memberships of UserA you will only get GroupA. But Users.IsInRole will indicate that UserA is a member of GroupB thanks to the nesting.