I’ve got an Active Directory synchronization tool (.NET 2.0 / C#) written as a Windows Service that I’ve been working on for a while and have recently been tasked with adding the ability to drive events based on changes in group membership. The basic scenario is that users are synchronized with a security database and, when group membership changes, the users need to have their access rights changed (ie. if I am now a member of ‘IT Staff’ then I should automatically receive access to the server room, if I am removed from that group then I should automatically lose access to the server room).
The problem is that when doing a DirectorySynchronization against groups you receive back the group that has had a member added/removed, and from there when you grab the members list you get back the list of all members in that group currently not just the members that have been added or removed. This leads me to quite an efficiency problem – that being that in order to know if a user has been added or removed I will have to keep locally a list of each group and all members and compare that against the current list to see who has been added (not in local list), and who has been deleted (in local list, not in current members list).
I’m debating just storing the group membership details in a DataSet in memory and writing to disk each time I’ve processed new membership changes. That way if the service stops/crashes or the machine is rebooted I can still get to the current state of the Active Directory within the security database by comparing the last information on disk to that from the current group membership list. However, this seems terrible inefficient – running through every member in the group to compare against what is in the dataset and then writing out changes to disk each time there are changes to the list.
Has anyone dealt with this scenario before? Is there some way that I haven’t found to retrieve only a delta of group members? What would you do in this situation to ensure that you never miss any changes while taking the smallest performance hit possible?
Edit: The AD might contain 500 users, it might contain 200,000 users – it depends on the customer, and on top of that how many groups the average user is a member of
I’d say it depends on how many active directory objects you need to keep track of. If it’s a small number (less than 1000 users) you can probably serialize your state data to disk with little noticable performance hit. If you’re dealing with a very large number of objects it might be more efficient to create a simple persistence schema in something like SQL Express and use that.