Active Directory and LDAP

Getting type conversion error accessing property value from AD, using webservice call into autocomplete extender

rizstates — Tue, 17 Nov 2009 16:03:39 GMT

Hello, I am using WebService to return data from active directory I am getting error at the following line:

Dim phone As String = result.Properties("telephonenumber")(0).ToString()
I am returning array to auto complete extender for textbox. The first few records go thorugh ok, but when it reaches a particular record , it does not like something in the phonenumber field.

  <WebMethod()> _
    Public Function findUser(ByVal prefixText As String) As String()
       
        Dim directory As DirectoryEntry = New DirectoryEntry ("LDAP://DC=ms,DC=XXXXXX,DC=com")

        Dim filter As String = "(&(cn=*" & prefixText & "*)(objectClass=Person)(objectClass=organizationalPerson)(objectClass=user)(!objectClass=computer)(!objectClass=nTFRSMember))"

        Dim strCats() As String = {"cn", "telephonenumber"}
        Dim items As New List(Of String)
        Dim dirUser As DirectorySearcher = New DirectorySearcher(directory, filter, strCats, SearchScope.Subtree)
      
        Dim results As SearchResultCollection = dirUser.FindAll

 
        Try
            Dim result As SearchResult
            Dim iCount As Integer

            If (results.Count > 0) Then
                For Each result In results
                    For iCount = 0 To result.Properties("cn").Count - 1
                        
                        Dim fullName As String = result.Properties("cn")(0).ToString()
                        Dim phone As String = result.Properties("telephonenumber")(0).ToString() 
                        items.Add(fullName & ", " & phone)
                        iCount = iCount + 1
                    Next
                Next
            End If
            items.Sort
                     
        Catch ex As Exception
            Print(ex.Message)

        End Try
        Return items.ToArray()
    End Function

Error:

System.InvalidCastException: Conversion from string "Index was out of range. Must be " to type 'Integer' is not valid. ---> System.FormatException: Input string was not in a correct format. at Microsoft.VisualBasic.CompilerServices.Conversions.ParseDouble(String Value, NumberFormatInfo NumberFormat) at Microsoft.VisualBasic.CompilerServices.Conversions.ToInteger(String Value) --- End of inner exception stack trace --- at Microsoft.VisualBasic.CompilerServices.Conversions.ToInteger(String Value) at DirectoryServices.findUser(String prefixText) in C:\Documents and Settings\AtiqueM\My Documents\Visual Studio 2008\WebSites\EmployeeDirectory\App_Code\DirectoryServices.vb:line 73

Active Directory Properties

luketongs — Mon, 23 Nov 2009 00:31:48 GMT

Hi guys,
with help I've figured out how to set the "user cannot change password" in C# using the code below. I'm now trying to figure out how to remove the property. I thought setting the denied flag to "allow" would work but it seems to do nothing. I would like the code to be using DirectoryEntry and not PrincipalContext if possible as I'm not sure if my app will be using .NET 3.5 on all the servers. Any help on this would be greatly appreciated.

string PASSWORD_GUID = "{ab721a53-1e2f-11d0-9819-00aa0040529b}";
string [] trustees = {"NT AUTHORITY\\SELF", "EVERYONE"};

ActiveDs.IADsSecurityDescriptor sd = (ActiveDs.IADsSecurityDescriptor)User.Properties["ntSecurityDescriptor"].Value;
ActiveDs.IADsAccessControlList acl = (ActiveDs.IADsAccessControlList) sd.DiscretionaryAcl;
ActiveDs.AccessControlEntry ace = new ActiveDs.AccessControlEntry();        


double denied = (double)ActiveDs.ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_DENIED_OBJECT;
double objectType = (double)ActiveDs.ADS_FLAGTYPE_ENUM.ADS_FLAG_OBJECT_TYPE_PRESENT;
double dsControl = (double)ActiveDs.ADS_RIGHTS_ENUM.ADS_RIGHT_DS_CONTROL_ACCESS;

foreach (string trustee in trustees) {
    ace.Trustee = trustee;
    ace.AceFlags = 0;                
    ace.AceType = Convert.ToInt32(Math.Floor(denied));
    ace.Flags = Convert.ToInt32(Math.Floor(objectType));
    ace.ObjectType = PASSWORD_GUID;
    ace.AccessMask = Convert.ToInt32(Math.Floor(dsControl));

    acl.AddAce(ace);
}
sd.DiscretionaryAcl = acl;
User.Properties["ntSecurityDescriptor"].Value = sd;
User.CommitChanges();

Help - 'groupOfUniqueNames' Class Problem

sjunejo — Sat, 21 Nov 2009 05:53:26 GMT

Hi,

I installed ADAM on my WindowXP Professional and created an instance successfully. By default there is no option for me to create a group with class 'groupOfUniqueNames' with 'uniqueMember' as its one of the attribute in active directory. So I opened a 'mmc' console and connected to my Active Directory instance using 'ADAM Schema' as snap in. It gave me two folders called 'Classes' and 'Attributes'. First I created an attribute by right click on 'Attributes --> New --> Attribute' and provide following information;

Name: uniqueMember

Description : uniqueMember

X500.OID : 2.5.4.50

Syntax : Unicode String

Attribute is active : True

Then I created a new class called 'groupOfUniqueNames' (type: structural) by adding above attribute 'uniqueMemebr' and 'o' as its optional attribute list and left the required attribute list empty.

But now when restarted my instance even restarted my machine I still can not see this new class to create an object. I am trying to create object by opneing a 'ADAM-adsiedit' console and connect to my instance. Right click on 'CN=Roles --> New --> Object' a pop opens with many options like 'container, user, inetOrPerson, groupOfNames, group etc. etc.' but NOT 'groupOfUniqueNames'.

My windows user is part of administrator group.

Any thoughts what am I missing?

Thanks

SJunejo

Converting Users SID in AD to a string.

TBarton — Fri, 20 Nov 2009 16:33:12 GMT

Hello all,

I am using VB.net and I am trying to get the SID of a user and then convert it to a string. I looked on line and found some code and pieced the code below together but I am getting a "Unable to cast Byte[]" error.

Any help would be appreciated.

    Shared Function GetUserSID(ByVal strDOMAIN As String, ByVal strUSER As String, ByVal strPASSWORD As String) As String
        Dim strSID As String
        Dim UserEntry As DirectoryEntry = New DirectoryEntry("LDAP://" & strDOMAIN, strUSER, strPASSWORD)
        Dim MySearcher As DirectorySearcher = New DirectorySearcher(UserEntry)
        MySearcher.Filter = "(sAMAccountName=" & strUSER & ")"
        Dim result As SearchResult = MySearcher.FindOne()
        Dim directoryObject As DirectoryEntry = result.GetDirectoryEntry()
        'strdn = directoryObject.Properties("distinguishedName").Value
        'fullname = directoryObject.Properties("displayname").Value
        'sidhex = directoryObject.Properties("objectSid").Value
        'objguid = directoryObject.Guid.ToString("B")


        'sidhex = directoryObject.Properties("objectSid").Item(0)    ' in my test the byte field looks like this : 01 02 00 00 00 00.......37 02 00 00
        Dim SID As System.Security.Principal.SecurityIdentifier
        SID = CType(directoryObject.Properties("objectSid").Value, System.Security.Principal.SecurityIdentifier)

        strSID = SID.Value

        Return strSID

    End Function

Thanks,

Query on Active directory - Locale containers

madan_84 — Fri, 20 Nov 2009 11:33:50 GMT

Hi, I'm a beginner on AD & scripting.

I have simple vb script which adds a menu item to the adminContextMenu for the US-English locale (409 container). The menu item has been added to the user-display object.

However I would like to know how can I add the menu item for all supported locales on a server machine. (CN=401, 402, 40C …… etc.,). Currently, I have a VBScript which does this … So, please let me know if anything could be done on VBScript to get all the decimal values for the locale as an array, so that probably I can iterate over it to add the menu item to all locales ...

Or is there a way to programmatically find out which locale in the Active directory is currently used/active?

Removing User from Groups

m.hakmeh — Sun, 22 Jun 2008 07:16:22 GMT

hey all

is it possible to remove one user from all groups ?

because i have about 1200 user and everyone could be in many groups, so what i want to do is to take the user and remove him from all groups that he belongs

thank you

VB Visual Studio 2008 Active Directory Login

chuuburg — Fri, 20 Nov 2009 02:19:02 GMT

Hi, i need some help with using Visual studio 2008 to login using active directory.
The programming language i am using is VB
Because i have to insert into an audit_log database to record down when the user logins (both failed and successful)
But i am unable to figure out how to check for the wrong password.

A short version of the codes im currently using:

adUser = ActiveDirAuthentication.AuthUser(Me.cboActiveDirectory.SelectedItem.ToString, Me.txt_username.Text, Me.txt_pw.Text)

If adUser Is Nothing Then

lbl_invalid.Text = "Invalid Login!"

Else

"Login is successful"

End If

What i do not know is that if adUser is nothing what does it signify?
What value would the adUser return?
The incorrect password in the Active Directory is wrong ? or there is no existing user in the AD.

Thanks

System.Byte[]

KBShah — Thu, 19 Nov 2009 15:59:23 GMT

I am querying active directory data for an app.

For all the AD attriutes that I am looking for I get the correct information

For example

string DistinguishedName = sr.Properties["DistinguishedName"][0].ToString();

gives me the correct distinguished name

However for the company info

string company = cast(sr.Properties["company"][0].ToString();

I get the System.Byte[] as the value for the string company

I do not understand why I am getting the data type of the object for company wheras for all other objects I am getting the value of the AD attribute...

Appreciate any help!

Binding with trusted user credetials via LDAP protocol

egp_qumu — Wed, 18 Nov 2009 17:49:49 GMT

I am wondering, if I have a trust set up bewteen domains, is it possible to do a bind (for authentication purposes) of a user from the the trusted domain to the trusting domain? That is I have domaina/user1 and they are logging into our application, which is configured to work with domainb -- there is a two way trust between domaina and domainb -- so I would like to take the credentials given to me by domaina\user1 and bind to domainb to authenticate them.

Also, when I do a search of domainb through the global catalog and I get a referal to domaina, I would like to be able to follow those referrals with credentials I originally used to bind to domainb (which are credentails from a user in domainb -- i.e. user2@domainb.com)

So are these scenarios possible (I am binding via the Java's JNDI API)? What configuration do I have to do to enable such binding to take place?

Moving to AD in existing .NET site?

robt1 — Wed, 18 Nov 2009 17:08:45 GMT

AD Question (Moving to AD in existing .NET site?):

I am working on an intranet/extranet site that is currently using forms authentication and the .NET membership database. We are

considering making the shift to AD for the internal (intranet) users but would like to keep the external (extranet) users in the

membership database. The intranet and extranet are sub domains on the same server.

1. Are there any issues with the basic configuration described above?

2. We would like to continue using forms authentication for the extranet users. Any issues with running windows authentication for the

intranet and forms authentication for the extranet site on the same server? Or, are we better off using forms authentication for both?

3. I'm struggling a bit with how best to add new users and keep AD in sync with our intranet/extranet SQL Server db. We are storing

quite a bit of our user data in our SQL server intranet/extranet db as opposed to the membership db. Currently we store the

"userproviderkey", generated by .net membership provider, in our intranet/extranet db to sync to 2 databases. How are sites typically

handling this when using AD? And, I assume we'd add a new user to AD first, then from the intranet find the user in AD and create a

"sync'd" record in our sql db?

4. We would administer roles in AD and only touch them in the intranet to authorize. Any issues here?

Thanks for your help!

I am working on an intranet/extranet site that is currently using forms authentication and the .NET membership database. We are considering making the shift to AD for the internal (intranet) users but would like to keep the external (extranet) users in the membership database. The intranet and extranet are sub domains on the same server.

1. Are there any issues with the basic configuration described above?

2. We would like to continue using forms authentication for the extranet users. Any issues with running windows authentication for the intranet and forms authentication for the extranet site on the same server? Or, are we better off using forms authentication for both?

3. I'm struggling a bit with how best to add new users and keep AD in sync with our intranet/extranet SQL Server db. We are storing quite a bit of our user data in our SQL server intranet/extranet db as opposed to the membership db. Currently we store the "userproviderkey", generated by .net membership provider, in our intranet/extranet db to sync to 2 databases. How are sites typically handling this when using AD? And, I assume we'd add a new user to AD first, then from the intranet find the user in AD and create a "sync'd" record in our sql db?

4. We would administer roles in AD and only touch them in the intranet to authorize. Any issues here?

Thanks for your help!

global to universal

stevedale — Wed, 18 Nov 2009 09:16:34 GMT

Does anyone have a code example of how to change an AD group from global to universal?

Thanks,

Steve

User Search in two domains

rpv — Tue, 17 Nov 2009 17:29:42 GMT

Hi all

Am using Active directory query to search for users and autopopulate user properties like employee number and office code. It was working fine until another domain had to be searched as well. I understand from my infrastructure team that there is a trust between both these domains.

I have two users(u1 and u2) set up in two different domains(d1 and d2). When u1 in d1 searches for another user in d1, search is successful and all properties are autopopulated. When u2 in d2 searches for the same user in d1, search is successful, but the office code does not get populated. Being new to AD, do not know in which direction I should search for infomration. Any help is greatly appreciated. Thank you!

Searching people in an Organizational Unit?

Rranv — Tue, 17 Nov 2009 18:53:34 GMT

I'm somewhat new to Active Directory and LDAP.  I have a question about searching.  I'm not sure if this can be done:
I'd like to execute a search that returns all the people (inetorgperson) in a specified organizational unit.

For example, here is a directory:

ou=Sales
  cn=john
  cn=dave
ou=Finance
  cn=jane
  cn=phil

I'd like to execute a search that returns all the people in ou Sales.  Can this be done with a single LDAP search filter? Or, do I have to bind to the Sales OU with a DirectoryEntry and then search all objects with a class of inetOrgPerson?

Thanks.

Query on LDAP server using ASP.net and VB

Owbon — Tue, 17 Nov 2009 16:02:14 GMT

Hiya,

I'm creating a web form and i want a user to be able to put in their ID number and for it to go away and query and to fill in there Name, phone number ect ...

Not sure where to start or how to query ...

Can someone give me an example or a good link? I have looked on the net and i can't seem to find anything good and no completely mind blowing.

Many Thanks

Request.ServerVaiables

danyeung — Mon, 16 Nov 2009 16:45:52 GMT

Both Request.ServerVaiables("LOGON_USER") and Request.ServerVaiables("AUTH_USER") return DOMAIN\Login. My company Active Directory is using both DOMAIN\Login and firstname.lastname@companyname.com and soon will have only firstname.lastname@companyname.com. How can I get the firstname.lastname@companyname.com from ASP.Net?

Thanks.

DanYeung

Accessing LDAP using identity stored in web.config

eseidel — Mon, 16 Nov 2009 17:53:03 GMT

I am trying to connect to LDAp server but can't figure out how to pass in the account.

the user account Im trying to login with is the one in web.config, stored as follows:

So how do i get these credentials out for accessing LDAP like so:

// gets ldap connection from appSettings

string domain = String.Format("LDAP://{0}",WebConfigUtility.GetString(LDAP);

DirectoryEntry entry = new DirectoryEntry(domain, <username>,<password>,<authenticationType>);

I figure I can get the username using System.Security.Principal.WindowsIdentity.GetCurrent().Name, but what about the password?

Any help would be great. Thanks.

Eric

add group to group

stevedale — Mon, 16 Nov 2009 13:44:02 GMT

Can anyone tell me why the following code throws an exception?

Thanks,

Steve

Slow Logon with Active Directory Forms Authentication

gsdtech — Tue, 10 Mar 2009 22:56:46 GMT

My application uses Active Directory Forms Authentication. The login process is painfully slow, usually around 63 seconds. This happens any time any user logs in. App performance is fine as soon as the user is logged in, but very slow while the initial login request processes. I'm not having any other LDAP performance issues that would lead me to believe this is a network problem.

The login page and web.config are here. I would love any guidance that can be provided to speed up the login process.

<%@ Page Language="VB" AutoEventWireup="false" CodeFile="login.aspx.vb" Inherits="login1" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>Helpdesk</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
        <center><asp:Login id="Login1" runat="server" TitleText="Helpdesk" DisplayRememberMe="False"></asp:Login>
        <br />
        <asp:panel runat="server" ID="pnlInstruction" Font-Names="Verdana" 
                Font-Size="Large" style="text-align: justify" Width="350px">To enter this 
            website, provide the username and password you use when logging on to your
            computer.</asp:panel> 
</center>
    </div>
    </form>
</body>
</html>

<?xml version="1.0"?>
<!-- 

-->
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
	<!--AJAX Setup-->
	<configSections>
		<sectionGroup name="system.web.extensions" type="System.Web.Configuration.SystemWebExtensionsSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
			<sectionGroup name="scripting" type="System.Web.Configuration.ScriptingSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
				<section name="scriptResourceHandler" type="System.Web.Configuration.ScriptingScriptResourceHandlerSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"/>
				<sectionGroup name="webServices" type="System.Web.Configuration.ScriptingWebServicesSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
					<section name="jsonSerialization" type="System.Web.Configuration.ScriptingJsonSerializationSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="Everywhere"/>
					<section name="profileService" type="System.Web.Configuration.ScriptingProfileServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"/>
					<section name="authenticationService" type="System.Web.Configuration.ScriptingAuthenticationServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"/>
					<section name="roleService" type="System.Web.Configuration.ScriptingRoleServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"/></sectionGroup>
			</sectionGroup>
		</sectionGroup>
	</configSections>
	<connectionStrings>
		<!-- Override default personalization storage and point to SQL DB-->
		<remove name="LocalSqlServer"/>
		<add name="LocalSqlServer" connectionString="Data Source=SQL1;Initial Catalog=HelpdeskMembership;Integrated Security=True" providerName="System.Data.SqlClient"/>
		<!-- Primary application data storage location-->
		<add name="ConnectionString" connectionString="Data Source=SQL1;Initial Catalog=Helpdesk;Integrated Security=True" providerName="System.Data.SqlClient"/>
		<!--Connection to Active Directory for integrated authentication features-->
		<add name="ADConnectionString" connectionString="LDAP://mydomain.local/OU=GSD,DC=mydomain,DC=local"/>
  </connectionStrings>
	<!--Set global values to use throughout the application-->
	<!--Call these values using the syntax-->
	<!--ConfigurationManager.AppSettings("keyName")-->
	<appSettings>
		<!--EMAILING_ENABLED-->
		<!--Enables/Disables email delivery when-->
		<!--tickets are created, updated, or closed.-->
		<!--Set value="True" to enable, value="False" to disable -->
		<add key="Emailing_Enabled" value="True"/>
		<!--MYADSPATH-->
		<!--The LDAP path to the root user container in Active Directory-->
		<add key="myADSPath" value="LDAP://OU=GSD,DC=mydomain,DC=local"/>
		<!--MYAPPUSERGROUP-->
		<!--The AD Security Group that contains users that-->
		<!--can be assigned Roles in the Helpdesk-->
		<add key="myAppUserGroup" value="Helpdesk Users"/>
		<!--TICKETSTATUS-->
		<!--An index of Ticket status values that are stored in-->
		<!--the database. They're also listed here for faster reference-->
		<!--<add key="TicketStatus-Open" value="1"/>
		<add key="TicketStatus-Closed" value="2"/>
		<add key="TicketStatus-WaitingForCustomer" value="3"/>
		<add key="TicketStatus-WatingForPart" value="4"/>-->
		<!--TICKETURL-->
		<!--The root URL to tickets in this application-->
		<add key="TicketURL" value="https://MYSITEURL/ticketdetail.aspx?tid="/>
	</appSettings>
	<system.web>
		<!--Enable roles-->
		<!--If the roleManager attribute defaultProvider-->
		<!--is set ="AspNetWindowsTokenRoleProvider" AD-->
		<!--groups can be used for roles.-->
		<roleManager enabled="true" cookieProtection="All" cookieRequireSSL="True"/>
		<!--Use Active Directory Forms authentication-->
		<!--Log off users after 60 minutes of inactivity-->
		<authentication mode="Forms">
			<forms name=".ADAuthCookie" timeout="60" protection="All">
			</forms>
		</authentication>
		<!--Require all cookies to travel over a secure channel-->
		<!--httpOnlyCookies="True" prevents cross-site scripting (script insertion in form fields)-->
		<!--http://msdn2.microsoft.com/en-us/library/ms228262.aspx-->
		<httpCookies requireSSL="true" httpOnlyCookies="true"/>
		<!--Allow only authenticated users only, redirect all others to the login page.-->
		<authorization>
			<deny users="?"/>
		</authorization>
		<!--Use the AD membership provider to allow domain logins. Set attributeMapUsername="sAMAccountName" -->
		<!--to allow users to log in with their SAMAccountName instead of their full UPN.-->
		<!--Set enablesearchmethods="true" to pull AD users into the ASP.NET Configuration Website-->
		<!--so they can be assigned to Roles.-->
		<membership defaultProvider="MyADMembershipProvider">
			<providers>
				<add name="MyADMembershipProvider" enableSearchMethods="true" type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, 
 Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ADConnectionString" attributeMapUsername="sAMAccountName"/>
			</providers>
		</membership>
		<profile>
			<properties>
				<!--Properties to store in each user's ASP.NET profile-->
				<!--These values are populated when a user loads the Helpdesk home page-->
				<!--See default.aspx for more info-->
				<add name="FirstName" type="string"/>
				<add name="LastName" type="string"/>
				<add name="samAccountName" type="string"/>
				<add name="DisplayName" type="string"/>
				<add name="Email" type="string"/>
			</properties>
		</profile>
		<!--Show users the SiteMap, but only the levels their Role is permitted-->
		<!--by setting securityTrimmingEnabled="true". This settings results in -->
		<!--the custom toolbar that users see in the top nav because-->
		<!--the unordered list is bound to the SiteMap (see MasterPage.Master). -->
		<siteMap defaultProvider="AspNetXmlSiteMapProvider" enabled="true">
			<providers>
				<remove name="AspNetXmlSiteMapProvider"/>
				<add name="AspNetXmlSiteMapProvider" type="System.Web.XmlSiteMapProvider" securityTrimmingEnabled="true" siteMapFile="web.sitemap"/>
			</providers>
		</siteMap>
		<!--   Set compilation debug="true" to insert debugging 
            symbols into the compiled page. Because this 
            affects performance, set this value to true only 
            during development.
        -->
		<compilation debug="true" strict="false" explicit="true">
			<assemblies>
				<add assembly="System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
				<add assembly="System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
				<add assembly="System.Management, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
				<add assembly="System.DirectoryServices.Protocols, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
				<add assembly="System.DirectoryServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
				<add assembly="System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
				<add assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
				<add assembly="System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
				<add assembly="System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
				<add assembly="System.Web.Extensions.Design, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/></assemblies>
		</compilation>
		<!--AJAX Setup-->
		<httpHandlers>
			<remove verb="*" path="*.asmx"/>
			<add verb="*" path="*.asmx" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
			<add verb="*" path="*_AppService.axd" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
			<add verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" validate="false"/>
		</httpHandlers>
		<!--AJAX Setup-->
		<httpModules>
			<add name="ScriptModule" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
		</httpModules>
		<!--Apply the Helpdesk theme and its skin to all pages-->
		<pages theme="GSD" enableEventValidation="false" viewStateEncryptionMode="Never">
      <namespaces>
				<clear/>
				<add namespace="System"/>
				<add namespace="System.Collections"/>
				<add namespace="System.Collections.Specialized"/>
				<add namespace="System.Configuration"/>
				<add namespace="System.Data"/>
				<add namespace="System.Text"/>
				<add namespace="System.Text.RegularExpressions"/>
				<add namespace="System.Web"/>
				<add namespace="System.Web.Caching"/>
				<add namespace="System.Web.SessionState"/>
				<add namespace="System.Web.Security"/>
				<add namespace="System.Web.Profile"/>
				<add namespace="System.Web.UI"/>
				<add namespace="System.Web.UI.WebControls"/>
				<add namespace="System.Web.UI.WebControls.WebParts"/>
				<add namespace="System.Web.UI.HtmlControls"/>
				<add namespace="System.DirectoryServices"/>
			</namespaces>
			<controls>
				<add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
				<add tagPrefix="asp" namespace="System.Web.UI.WebControls" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/></controls>
			<tagMapping>
			</tagMapping>
		</pages>
		<!--
            The <customErrors> section enables configuration 
            of what to do if/when an unhandled error occurs 
            during the execution of a request. Specifically, 
            it enables developers to configure html error pages 
            to be displayed in place of a error stack trace.
-->
		<customErrors mode="Off" />
	</system.web>
	<!---Enable simplified mail delivery using custom class MailHelper.VB-->
	<system.net>
		<mailSettings>
			<smtp>
				<network host="eml1.mydomain.local" port="25" userName="" password=""/>
			</smtp>
		</mailSettings>
	</system.net>
	<system.webServer>
		<validation validateIntegratedModeConfiguration="false"/>
		<modules>
			<remove name="ScriptModule"/>
      <add name="ScriptModule" preCondition="managedHandler" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
		</modules>
		<handlers>
			<remove name="ScriptHandlerFactory"/>
			<remove name="ScriptHandlerFactoryAppServices"/>
			<remove name="ScriptResource"/><remove name="WebServiceHandlerFactory-Integrated"/>
			<add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
			<add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
			<add name="ScriptResource" preCondition="integratedMode" verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
		</handlers>
	</system.webServer>
	<runtime>
		<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
			<dependentAssembly>
				<assemblyIdentity name="System.Web.Extensions" publicKeyToken="31bf3856ad364e35"/>
				<bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0"/>
      </dependentAssembly>
			<dependentAssembly>
				<assemblyIdentity name="System.Web.Extensions.Design" publicKeyToken="31bf3856ad364e35"/>
				<bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0"/>
      </dependentAssembly>
    </assemblyBinding>
  </runtime>
</configuration>

Why might LdapConnection.Bind() be slow?

bgs264 — Tue, 18 Nov 2008 11:50:11 GMT

Hi,

I'm using the System.DirectoryServices.Protocols namespace (LdapConnection class) to bind to a Windows AD server. I'm using SSL (.SecureSocketLayer = true) and binding to port 636 on the AD server.

On my development machine, I'm having no problems. The .Bind() method takes only a fraction of a second to bind to the server, and everything is well.

However, when I deploy the application (it's a web application) to a server, the .Bind() method is slow. My code is like this:

                    HttpContext.Current.Trace.Write("Authenticate LDAP User point 3")
                    ldapConn.Bind()
                    HttpContext.Current.Trace.Write("Authenticate LDAP User point 4")

When I look in the trace file, it takes 13.x seconds to get between point 3 and 4. The x varies, but the time is always between 13 to 13.5 seconds.

So, any ideas why the binding would be so slow from a server, but so fast from my dev machine? I'd appreciate some things I could check, like

Any components that may be on one PC but not another
Any configuration I may need to make on the AD server
Anything more detailed tracing I can run to find out which bit of LdapConnection.Bind() is so slow

UPDATE: I have found that adding impersonation into the web.config and impersonating a domain user "solves" this problem and makes it very quick to bind, just like on my development machine. I'm still curious why this solves the problem though.. Is it something to do with the machine already having bound to AD to validate the impersonation credentials?

Thanks,

bgs264

Logon failure: unknown user name or bad password

jagjot — Fri, 25 May 2007 14:23:52 GMT

HI Folks,

Here is my code. when i run using vs 2005 it works fine. but when i try to run using localhost/app/page.aspx it pops up with error.

Logon failure: unknown user name or bad password.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.DirectoryServices.DirectoryServicesCOMException: Logon failure: unknown user name or bad password.

Source Error:

Line 57: 
Line 58:         'Make a serach result
Line 59:         Dim sr As SearchResult = searcher.FindOne

Code

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Dim dirObject As New DirectoryEntry(LDAP://ldap-server.eu.company.net)

Dim searcher As New DirectorySearcher(dirObject)

searcher.Filter = "sAMAccountName=" + "yds3k5k3"

searcher.PropertiesToLoad.Add("cn")

Dim sr As SearchResult = searcher.FindOne

Dim strVal As String = sr.Properties("cn").Item(0).ToString

Response.Write(strVal)

please help.

Jag

Check if e-mail already exist

utlandsfantomenno1 — Mon, 09 Nov 2009 13:32:58 GMT

Hello!

Currently I check if a user name exists before I create users like this:

    Public Function UserExists(ByVal username As String) As Boolean
        Dim de As DirectoryEnTry = GetDirectoryEnTry()
        Dim deSearch As DirectorySearcher = New DirectorySearcher()

        deSearch.SearchRoot = de
        deSearch.Filter = "(&(objectClass=user) (cn=" + username + "))"

        Dim results As SearchResultCollection = deSearch.FindAll()

        Return results.Count > 0
    End Function

How would I go about checking if a e-mail already exists?

Cheers!

/Eskil

Creating custom application privileges in AD

bdm782 — Thu, 05 Nov 2009 21:03:35 GMT

I'm working on an application that will need to utilize a bunch of custom privileges that will be granted to various users of the application. So for instance, there will be privileges in the app like:

print reports
update profile data
create new reports
delete reports
add users

and so on (there are about 20-30 distinct privileges specific to the application).

We would like to be able to manage these privileges for users in Active Directory by groups or somesuch manner.

What is the best way to implement this in Active Directory?

One idea that has been kicked around was to add these as custom attributes by modifying the active directory schema. Is that really the best way to go, or are there alternatives?

thanks, Bob

List all the Subnets within a SITE in a directory service

kamlesh_g_k — Fri, 06 Nov 2009 03:55:22 GMT

Hi LDAP gurus,

We have a requirement to query a directory service (it can be any Microsoft ADS, IBM tivoli, Open Directory, Apache Directory etc) and extract all the SITES belonging to the DS.

And when user selects a SITE we should show all the subnets belonging to the SITE.

I have used the functions in the 'wldalp32.dll' and got all the SITES under the DS.

The following code got all the SITES
PWCHAR="CN=Sites,CN=Configuration,DC=myDomain,DC=com"
ULONG errorCode = LDAP_SUCCESS;
LDAPMessage* pSearchResult;
PWCHAR pMyFilter = L"(&(objectCategory=site))";
WCHAR **pMyAttributes = new WCHAR*[6];

pMyAttributes[0] = L"cn";
pMyAttributes[1] = L"company";
pMyAttributes[2] = L"department";
pMyAttributes[3] = L"telephoneNumber";
pMyAttributes[4] = L"memberOf";
pMyAttributes[5] = NULL;

errorCode = ldap_search_s(
pLdapConnection,
pMyDN,
pMyFilter, // Filter
pMyAttributes,
0,
&pSearchResult);

I have a couple of questions
a) SITES - Is this an Ms Active Directory concept. Do non AD directory services have SITES?

b) If some directory services does not have SITES configured, am sure the above code would return an error. In that case we just will get all the subnets listed in the directory service. Is this approach good enuf to ensure that we support all directory services?

Any answers would be appreciated.

911Urgent911

clos_man — Wed, 06 May 2009 01:39:19 GMT

Can anybody help me? I am having trouble finding a solution to the following scenario:

You are an independent contractor who specializes in Microsoft’s Active Directory. You have taken on as a client a local hospital. The hospital has 25 domain controllers located in 9 departments around the hospital. All domain controllers are connected through the LAN. Three departments are using older, 10-Mbps hubs, while the other departments are using 10/100-Mbps switches. Between the hours of 8:00 AM and 6 PM, the network bandwidth utilization averages 95%. A research team just leased office space in a building located across town to house 20 researchers. The new office currently has a 56-Kbps ISDN connection to the hospital that needs to be upgraded to a T1 within the next six months.The hospital’s IT manager is concerned that there is too much Active Directory replication occurring during the day, consuming the bulk of the available bandwidth in the hospital. You just found out that the researchers will be using Active Directory to store research subject data that will be constantly updated and modified. Senior researchers at the hospital will review this data. You are concerned this will cause network slowdown at the hospital. How should you design the hospital’s replication topology to minimize the amount and frequency of replication during the day? Feel free to create a network map to help explain your solution.You received a call from a researcher in the new facility informing you that changes made by network administrative staff located at the hospital do not seem to take effect at the new facility. Similarly, research subject data is not being replicated from the new facility to the hospital. What tool(s) could you use to troubleshoot the issue? What are some possible causes of, and solutions to, this problem?

Scan the network and identify a directory service

kamlesh_g_k — Thu, 05 Nov 2009 05:30:56 GMT

Hi LDAP gurus!

We have a requirement to scan the network and identify a directory service.

I'm using the C++ library WinLDAP.h from Microsoft

(http://msdn.microsoft.com/en-us/library/aa367016(VS.85).aspx)

to search for a directory service....this is the code that initially gets the - 'rootDSE'

HRESULT hr;

CComVariant vartest, var, var1;

hr = ADsGetObject( L"LDAP://rootDSE",IID_IADs,(void**)

&pObject ); if ( !SUCCEEDED(hr) )

{

return -1;

}

hr = pObject-Get(CComBSTR(L"defaultNamingContext"),&var);

if ( !SUCCEEDED(hr) )

{

return -1;

}

I have 3 questions

a) Is this code good enuf to actually ensure that

the network has a directory service?

b) We are querying Active directory, but we should be able to

look for directory services like IBM trivoli, etc too.

c) How do we identify if the directory service found is Ms Active Directory or IBM tivoli etc

Any response would be appreciated.

Hi LDAP gurus!

We have a requirement to scan the network and identify a directory service.
I'm using the C++ library WinLDAP.h from Microsoft
(http://msdn.microsoft.com/en-us/library/aa367016(VS.85).aspx)

to search for a directory service....this is the code that initially gets the - 'rootDSE'

HRESULT hr;
CComVariant vartest, var, var1;

hr = ADsGetObject( L"LDAP://rootDSE",IID_IADs,(void**)

&pObject );

if ( !SUCCEEDED(hr) ){

return -1;
}

hr = pObject-Get(CComBSTR(L"defaultNamingContext"),&var);

if ( !SUCCEEDED(hr) )

{

return -1;

}

I have 3 questions

a) Is this code good enuf to actually ensure that the network has a directory service?

b) We are querying Active directory, but we should be able to look for directory services like IBM trivoli, etc too.

c) How do we identify if the directory service found is Ms Active Directory or IBM tivoli etc

Any response would be appreciated.

Active Directory and LDAP

Getting type conversion error accessing property value from AD, using webservice call into autocomplete extender

Active Directory Properties

Help - 'groupOfUniqueNames' Class Problem

Converting Users SID in AD to a string.

Query on Active directory - Locale containers

Removing User from Groups

VB Visual Studio 2008 Active Directory Login

System.Byte[]

Binding with trusted user credetials via LDAP protocol

Moving to AD in existing .NET site?

global to universal

User Search in two domains

Searching people in an Organizational Unit?

Query on LDAP server using ASP.net and VB

Request.ServerVaiables

Accessing LDAP using identity stored in web.config

add group to group

Slow Logon with Active Directory Forms Authentication

Why might LdapConnection.Bind() be slow?

Logon failure: unknown user name or bad password

Logon failure: unknown user name or bad password.

Check if e-mail already exist

Creating custom application privileges in AD

List all the Subnets within a SITE in a directory service

911**Urgent**911

Scan the network and identify a directory service

911Urgent911