I have written an ASP.Net page which performs a search of AD for a list of users. The code works perfectly on the development box (from within the ASP.Net development environment), and it works perfectly if you call the page from the browser on the web server, but it won't run if you call the page up using just the browser from any other computer (including the development box). There are no errors, it just does nothing when you click the button.

The application uses identity impersonation, and since I am a domain admin I shouldn't be having any access problems due to ACL's.

Permissions for ASP.Net and user accounts have all been set per the MSDN instructions here .

Does anyone have any ideas?

I have figured this out.

1. I went into Active Directory and opened up the computer account for the web server. I checked the box which says "Trust computer for delegation."
2. I opened up my user account and checked the box "Account is trusted for delegation." 

Now the search runs as expected.

This is what I used in a subroutine:

        Try
            Me.ListBox1.Items.Clear()
            Dim usr As String
            Dim val As String
            Dim cName As String
            Dim sPath As String = "LDAP://DC=XXXXXXXXXX,DC=com"
            If inFName <> "" And inLName <> "" Then
                cName = inFName & " " & inLName
            ElseIf inFName = "" Then
                cName = inLName
            ElseIf inLName = "" Then
                cName = inFName
            End If
            Dim myDirectory As New DirectoryEntry(sPath, "account name", "password")
            Dim mySearcher As New DirectorySearcher(myDirectory)
            mySearcher.Sort.PropertyName = "displayName"
            Dim mySearchResultColl As SearchResultCollection
            Dim mySearchResult As SearchResult
            Dim myResultPropColl As ResultPropertyCollection
            Dim myResultPropValueColl As ResultPropertyValueCollection
            ' Build the LDAP query
            If inFName <> "" And inLName <> "" Then
                mySearcher.Filter = ("(&(objectClass=user)(cn=" & cName & "))")
            ElseIf inFName = "" Then
                mySearcher.Filter = ("(&(objectClass=user)(sn=" & cName & "))")
            ElseIf inLName = "" Then
                mySearcher.Filter = ("(&(objectClass=user)(givenName=" & cName & "))")
            End If
            mySearcher.PropertiesToLoad.Add("displayName")
            mySearcher.PropertiesToLoad.Add("distinguishedName")
            mySearcher.PageSize = 999
            mySearchResultColl = mySearcher.FindAll()
            ' If results are returned, place into Listbox
            Select Case mySearchResultColl.Count
                Case 0
                    ' If no results, tell the user.
                    Me.ListBox1.Items.Add(New ListItem("No results were returned"))
                    Exit Function
                Case Else
                    For Each mySearchResult In mySearchResultColl
                        usr = mySearchResult.GetDirectoryEntry().Properties("displayName").Value & _
                        " - " & mySearchResult.GetDirectoryEntry().Properties("physicalDeliveryOfficeName").Value
                        val = mySearchResult.GetDirectoryEntry().Properties("distinguishedName").Value
                        Me.ListBox1.Items.Add(New ListItem(usr, val))
                    Next
            End Select
        Catch ex As Exception
        End Try

Thank you very much.

hi Nick,

I am working on a similar requirement and your code could be of real help for me! I actually have a doubt in the code which is the usage of the inFName, inLName. Can you tell me from where are you getting thier values or where are they defined or from where these variables are being used in this subroutine. I am not clear with the usage of these. It will be great if you can help me out on this. Thanks for posting the code.

thanks

siddhartha

inLName and inFName are names of text boxes on the form that calls this sub routine. I did it this way in case the user only knew the person's first or last name, they could still do a search and get a list of people with that name.

Thanks a lot Nick.