Question

I’m working on a web-based project that users will access after having been authenticated by Active Directory. My boss controls access to Active Directory, and wants to use groups to handle authentication to the application I’m writing. He’s also provided me with a class to connect to pull the information I need from AD (logon name and active directory groups), so that’s not a concern here.

Here’s my problem: most users belong to more than 20 AD groups. I’ve never worked with AD before, so I have no idea if this is abnormally high, but I do know that it takes 5-6 seconds for AD to respond to my request for user group lists, so I really want to minimize the number of times I have to request groups, especially since peak use will involve about 200-300 users hitting the page within a few hours.

This application has three separate control groups: users, reviewers, and administrators. Each group has their own collection of pages in their respective folders of the website. Each folder has one entry-point page (i.e., the others will redirect to this page if no pertinent data are found in the Session). This page checks for valid a AD group only if IsPostback == false, and reads from an entry in the Session object to make sure that the user has the proper access.

So (finally), here’s my question: Am I handling this in the most efficient way possible, or have I overlooked some simple alternative here?

Answer 1

For your issue above, yes AD sometimes is a bit slow depends on the load but rather than concentrating on that why not change your logic rather than ennumerating all the users groups why not check whether a user is a group member of. To implement it here is the code

/// <summary>
/// Checks if user is a member of a given group
/// </summary>
/// <param name="sUserName">The user you want to validate</param>
/// <param name="sGroupName">The group you want to check the membership of the user</param>
/// <returns>Returns true if user is a group member</returns>
public bool IsUserGroupMember(string sUserName, string sGroupName)
{
    UserPrincipal oUserPrincipal = GetUser(sUserName);
    GroupPrincipal oGroupPrincipal = GetGroup(sGroupName);

    if (oUserPrincipal == null || oGroupPrincipal == null)
    {
        return oGroupPrincipal.Members.Contains(oUserPrincipal);
    }
    else
    {
        return false;
    }
}

Or even better if you still want to prefer to use the ennumeration part, why not ennumerate only the groups on a specific OU rather than the whole directory like such

/// <summary>
/// Gets a list of the users group memberships
/// </summary>
/// <param name="sUserName">The user you want to get the group memberships</param>
/// <param name="sOU">The OU you want to search user groups from</param>
/// <returns>Returns an arraylist of group memberships</returns>
public ArrayList GetUserGroups(string sUserName, string sOU)
{

    ArrayList myItems = new ArrayList();
    UserPrincipal oUserPrincipal = GetUser(sUserName);

    PrincipalSearchResult<Principal> oPrincipalSearchResult = oUserPrincipal.GetGroups(GetPrincipalContext(sOU));

    foreach (Principal oResult in oPrincipalSearchResult)
    {
        myItems.Add(oResult.Name);
    }
    return myItems;

}
/// <summary>
/// Gets the principal context on specified OU
/// </summary>
/// <param name="sOU">The OU you want your Principal Context to run on</param>
/// <returns>Retruns the PrincipalContext object</returns>
public PrincipalContext GetPrincipalContext(string sOU)
{
    PrincipalContext oPrincipalContext = new PrincipalContext(ContextType.Domain, sDomain, sOU, ContextOptions.SimpleBind, sServiceUser, sServicePassword);
    return oPrincipalContext;
}        

Finally as a note if you value security more than speed then I would not suggest IsPostback == false so that if there are any changes on a Security Group Membership of a certain user then you will be able to capture it better on the next process.

For a full implementation of AD Methods please refer here
if you are using .Net 2.0

http://anyrest.wordpress.com/2010/02/01/active-directory-objects-and-c/

or if you are using .Net 3.5 or 4.0

http://anyrest.wordpress.com/2010/06/28/active-directory-c/