Is user member of group in C#

Question

Hello everyone,
I have to bind our application from ActiveDirectory to eDirectory. Is
there a simple way to determine if the currently logged in user is a
member of a group?
In ActiveDirectory this is really simple but in eDirectory (using the
LDAP C#-library) it seems that I always have to create LDAP strings
which always have to contain username and password (which is an
absolutely no-go in my opinion).
I found many articles to my problem but no one with an easy solution.
Perhaps someone got this running without the novell LDAP library through
Microsoft DirectoryServices-Namespace.
inno1
inno1's Profile: http://forums.novell.com/member.php?userid=109362
View this thread: http://forums.novell.com/showthread.php?t=437637

Answer 1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
A few things come to mind. First your authentication problem; binding
anonymously is definitely allowed in eDirectory, and is even allowed by
default, but that doesn't mean the environment you are hitting will allow
it. This is something you'll need to check with whomever setup the
eDirectory environment. The documentation should cover how to set
restrictions like anonymous binds.
Next we have what I'm guessing is how you are searching for the group. I
do not see how you are going to find either your group or your user in the
group using that code so I'll suggest something else that I think is
better taking advantage of the power of eDirectory and LDAP. First a
little more information about eDirectory. By default group memberships
are shown on both the group and user sides so you can either query the
entire directory for groups that have users in their 'members' attribute,
or you can go to the user and simply get a listing of all of the values in
the groupMembership attribute. This is the best way, in my opinion, to
see if a user is a member of a group.
Now, about finding the user. In LDAP environments objects are found by
full DNs, not just their relative DNs or usernames. If you do not have a
full DN (users seldom know the full DN or use them) the first step is to
find these, which you can do with a search like you are doing, although
hopefully you wouldn't need to loop through results. Having a query like
the following should find the user in one shot in a well-designed environment:
(&(objectClass=inetorgperson)(cn=userNameHere))
Once you have found the resulting DN of the user you can find the
groupMembership attribute and either use the full set of values in that
attribute or you can iterate through the values looking for the group DN.
For both user and group you must use the full DN to verify membership.
Good luck.
On 04/28/2011 02:36 AM, inno1 wrote:
>
> ab;2100491 Wrote:
>> The check for is a user is a member of a group does not require the
>> password...I ask because the samples from the LDAP-library (ListGroup.cs, for
> example) all seem to require a password. The samples check the number of
> command line arguments and if something is missing the program does not
> work.
>
> ab;2100491 Wrote:
>> what do you mean[..]
> I need a function like
> Code:
> --------------------
> bool UserIsMemberOf(string groupName) {}
> --------------------
> to determine if a user is a member of a group.
>
> I get the userName from Environment.UserName and the groupName the user
> has to be a member of is configured somewhere in my application.
>
> In ActiveDirectory I just connect to LDAP://RootDSE and everything
> works fine.
>
> ab;2100491 Wrote:
>> [..] and what does your code look like?
> I used the 'Using .NET C# LDAP Library'
> (http://www.novell.com/coolsolutions/...e/11204.html):
>
>
> Code:
> --------------------
> Anonymous Binding
>
> // C# Library namespace
> using Novell.Directory.Ldap;
>
> // Creating an LdapConnection instance
> LdapConnection ldapConn= new LdapConnection();
>
> //Connect function will create a socket connection to the server
> ldapConn.Connect (ldapHost,ldapPort);
>
> //Bind function with null user dn and password value will perform anonymous bind
> //to LDAP server
> ldapConn.Bind (null, null);
> --------------------
>
> After this ldapConn.Bound is false. Is this correct? It could be
> correct because I didn't really authenticate when doing anonymous
> binding but it could be also wrong because even an anonymous bind should
> be a form of authentication.
>
> I also tried Identity Bind:
>
>
> Code:
> --------------------
> Binding using an Identity
>
> // C# Library namespace
> using Novell.Directory.Ldap;
>
> // Creating an LdapConnection instance
> LdapConnection ldapConn= new LdapConnection();
>
> //Connect function will create a socket connection to the server
> ldapConn.Connect(ldapHost,ldapPort);
>
> //Bind function will Bind the user object Credentials to the Server
> ldapConn.Bind(userDN,userPasswd);
> --------------------
> After this, ldapConn.Bound is true but the user has to give a password.
> I don't want the user to have to use a password because in this case the
> user has to configure it somewhere in the configuration of my
> application.
>
> Then - for testing purposes - I wrote a function to get the users of a
> group:
>
>
> Code:
> --------------------
> LdapSearchResults lsc=ldapConn.Search("ou=Users,o=DomainAdmins", LdapConnection.SCOPE_ONE, "objectClass=*", null, false);
>
> string result = String.Empty;
>
> while (lsc.hasMore()) {
> LdapEntry nextEntry = null;
>
> try {
> nextEntry = lsc.next(); // <--- EXCEPTION: see [1]
> } catch(LdapException e) {
> result = String.Concat(result, "Error: ", e.LdapErrorMessage, Environment.NewLine);
> // Exception is thrown, go for next entry
> continue;
> }
>
> result = String.Concat(result, nextEntry.DN, Environment.NewLine);
>
> LdapAttributeSet attributeSet = nextEntry.getAttributeSet();
> System.Collections.IEnumerator ienum = attributeSet.GetEnumerator();
>
> while(ienum.MoveNext()) {
> LdapAttribute attribute=(LdapAttribute)ienum.Current;
> string attributeName = attribute.Name;
> string attributeVal = attribute.StringValue;
> result = String.Concat(result, attributeName, "value:", attributeVal, Environment.NewLine);
> }
> }
> --------------------
>
>
> [1] "00000000: LdapErr: DSID-0C090627, comment: In order to perform
> this operation a successful bind must be completed on the connection.
>
> I think this is the problem:
>
>
> Code:
> --------------------
> LdapSearchResults lsc=ldapConn.Search("ou=Users,o=DomainAdmins", LdapConnection.SCOPE_ONE, "objectClass=*", null, false);
> --------------------
>
>
> So, how does this have to look for a domain named "MyDomain.com" for a
> group named "DomainAdmins" if I want to get all members of this group?
>
> And how does this have to look if I want to know if a user named
> "myuser" is member of a group "mygroup" in domain "MyDomain.com"?
>
> I think this would help me a lot.
>
> ab;2100491 Wrote:
>> There may be a need for authentication that would require a
>> username/password but that depends on the rights you assign to your
>> tree
>> to allow (or deny) anonymous access.So, this is someone the customer has to configure I think. Since I only
> want to read from a domain it has to work some way without giving a
> password.
>
> ab;2100491 Wrote:
>> Good luck.Thank you very much!
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJNujvFAAoJEF+XTK08PnB5Vn4QAJ8wDKZw5h Q5AWWkeMhKZ57U
DctNKO9Wl1xU3agTp+PjgFFCQMHTiME7/UFU7/KR+eyY0hgp9R6r0k2lK3iX1TFd
1Zwg0rkEjV+Pydy7vHk/LvqpoyWYKhrSGHhvkj/RChiIj1yEKR0rgAXGZG8NPemO
nIXJtPHQ8ZkH8ZrEGfL+25abIc5b0Ch5KXN76nSFRGORgqPRvO 2gpQW36KKj+Tfq
RZARJgBKyKaG4MOlatnS2ZNuAy1meI/1oTN/ouO8K1MR+Hey2ZvI85VUSlg3nG/z
fgj6QdIMj80KRnpgJCO4K7SFO6effHQaijRUIszz5xHxSEaPXv FcB/xPhRdedzxb
NKZu/rti0Jt3PABCG3nibbUcA05vbb6mLbufwDISJGXyUp5PK3533yT xoGFjkt1I
PL+p7ZpL4Q5s4wHBGME0y579V5EfncqqUsFh2aONzhIAmOSxu0 huaqcLG5QWmQnQ
HMn8+npkdlyGGJy4hslpyoTQefYNsn7PdXig1KAMEZjQHGlI1S WJf/hsztcP4/jM
Zf8oKMZz/35+EphCgRgXl0h5gOFk+WpxHRJ8NyAVLZioV4mcUwBzLDD7d9z lW47/
SZxxlIOKpFB1c0FokkFR2SBteDsd4dzfMPgD7MTDBNj174u7wn y3LkSvWfPTDjBS
12SwchOZ+PPL3PxfsUNc
=/n4u
-----END PGP SIGNATURE-----