Unable to validate credentials using LDAP - c#

I am new to LDAP and wanted to connect to a LDAP server using .Net to validate the user credentials. The following code returns an error:
The LDAP server is unavailable
But the validation works fine in Java code. Kindly let me know where I have gone wrong.
using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, "LDAP://192.168.65.201:389/DC=be,DC=ndl,DC=CompanyName,DC=com"))
{
bool a= pc.ValidateCredentials("myname#CompanyName.com","password");
}

First of all - PrincipalContext only works against Active Directory, not against any other LDAP server.
Secondly: you're specifying invalid parameters for the constructor. Check out the MSDN docs on what constructors are available for PrincipalContext.
You can define just a ContextType parameter, in which case the PrincipalContext is constructed against the current domain you're connected to:
var ctx = new PrincipalContext(ContextType.Domain);
Or you can use a constructor with a second string parameter which signifies the domain name of your domain (only the domain name - NOT a complete LDAP path!):
var ctx = new PrincipalContext(ContextType.Domain, "CompanyName.com");
Then you're connected to that specific domain, at the root level.
Or thirdly, you can specify a third parameter which defines the container in that domain to connect to:
var ctx = new PrincipalContext(ContextType.Domain, "CompanyName.com",
"CN=Users,DC=be,DC=ndl,DC=CompanyName,DC=com");
So you'll need to find the appropriate constructor and supply the correct parameters to get this to work - if you're using Active Directory.

Related

How to get down-level logon name from UserPrincipal in .Net

I have the following search query where I use a User Principal Name identification:
PrincipalContext principalContext = new PrincipalContext(ContextType.Domain);
var user = UserPrincipal.FindByIdentity(principalContext, IdentityType.UserPrincipalName, "user1#domain1.local"); //the searched UPN will be dynamic!
After I get the UserPrincipal object, I have to create a down-level logon format (domain1\user1).
Unfortunately I have the following distinguished name:
CN=User One,OU=Every employee,DC=domain1,DC=local
It looks like user.Context.Name is null which is claimed to be the name of the domain.
Also, if the selected user is a local one, I should get the machine1\localuser1 value.
The SamAccountName contains only the user name, without the context (user1).
What is the best way to get that format from any UserPrincipal object?
If you need to do this for machine accounts, then your answer is the way to go.
But another way, strictly for Active Directory (in case it comes in handy some other time), is to look at the msDS-PrincipalName attribute, which you can get via the underlying DirectoryEntry object:
var de = (DirectoryEntry) user.GetUnderlyingObject();
de.RefreshCache(new [] { "msDS-PrincipalName" }); //retrieve it from AD
var domainUsername = de.Properties["msDS-PrincipalName"].Value;
Since it's a constructed attribute, it's not returned unless you specifically ask for it, which is what you use RefreshCache for.
The down-level logon format can be obtained via an NTAccount object. However, it requires some translation to convert the Principal's SID to an NTAccount:
string downLevelLogonName =
userPrincipal.Sid.Translate(typeof(System.Security.Principal.NTAccount)).ToString();
Using that code works in both case (domain or local computer users).

What PrincipalContext does UserPrincipal.GetGroups() use if not specified?

In the case that I'm getting groups for a UserPrincipal identity (in an Active Directory role provider), and I use the UserPrincipal.GetGroups() function that does not require a PrincipalContext as parameter, what does it default to using for the PrincipalContext? I ask as in troubleshooting an issue, I'm seeing seeing it connect to a different AD server that is not the connected server for my PrincipalContext. Some code as an example:
using ( PrincipalContext context = new PrincipalContext( ContextType.Domain, "domain", null, ContextOptions.Negotiate ) )
{
UserPrincipal identity = UserPrincipal.FindByIdentity( context, IdentityType.SamAccountName, username );
if (identity != null)
{
var groupList = identity.GetGroups();
}
}
If I output context.ConnectedServer I get a valid active server. However, identity.GetGroups() appears to connect to a different server (in my case, it's throwing a System.DirectoryServices.ActiveDirectory.ActiveDirectoryServerDownException because it's connecting to an old server). If I instead use identity.GetGroups(context), the groups are correctly returned. Why does calling GetGroups without a PrincipalContext cause it to default to connecting to a different server?

SimpleBind Authentication against Active Directory

I'm trying to authenticate login credentials against Active Directory (AD DS) using the following code:
using (var context = new PrincipalContext(ContextType.Domain, ipAddress))
{
Console.WriteLine("Connected to {0}:", context.ConnectedServer);
context.ValidateCredentials(username, password);
}
Where ipAddress is the address of the primary domain controller. However this gives the following error when attempting to read context.ConnectedServer:
System.DirectoryServices.DirectoryServicesCOMException (0x8007052E):
The username or password is incorrect.
In addition to this issue I have the following constraints:
The production environment may or may not be on the domain.
The clients do not want to enter any privileged credentials to query the directory.
Due to this second constraint I have tried to execute a SimpleBind, but without much luck:
using (var context = new PrincipalContext(ContextType.Domain,
ipAddress,
null,
ContextOptions.SimpleBind,
usernameToValidate,
password))
Based on these constraints, how can I authenticate against Active Directory?
I was able to authenticate using the following code:
using (var context = new PrincipalContext(ContextType.Domain, ipAddress))
{
// NOTE! Username must be of the format domain\username
return context.ValidateCredentials("domain\someuser", password, ContextOptions.SimpleBind);
}
The key part was to prefix the username with the short domain name. Once I did that, and specified SimpleBind in the call to ValidateCredentials instead of in the context constructor, it worked fine.

Unable to extract information

I'm trying to query a domain to determine if:
User is a valid user (and has the correct password)
User is enabled
User belongs to group x
My development machine does not belong to this domain.
I want to specify the username and password via my application
I'm using the System.DirectoryServices.AccountManagement namespace as this seems to be the most efficient way doing this, however I've struggling to get even the most basic of information out of my domain controller.
I can explore LDAP via another tool.
First test is to collect user information, the code below returns null on user.
The user however is valid.
What am I doing wrong?
// set up domain context
PrincipalContext ctx = new PrincipalContext(ContextType.Domain, "server","CN=Users,DC=doom,DC=home", "ldapuser","password");
// get user contect
UserPrincipal user = UserPrincipal.FindByIdentity(ctx, IdentityType.Name, username);
//is user locked?
var locked = user.Enabled;
Update:
Having defined the bind method as below, I now receive error
"Information about the domain could not be retrieved (1355)."
var ctx = new PrincipalContext(ContextType.Domain, "server", "DC=doom,DC=home", ContextOptions.SimpleBind, "ldapuser", "password");
Sorted.
This answer resolves the two issues I came across when attempting to connect to a domain controller that I am not a member of.
This article get me the final answer:
http://elegantcode.com/2009/03/21/one-scenario-where-the-systemdirectoryservices-accountmanagement-api-falls-down/
you need to define the Bind in the context (i.e. ContextOptions.SimpleBind)
You must set up the domain server in your Network adaptors DNS settings as the first DNS server to use.
I can now connect to my AD and collect data.

Cant find users or groups with System.DirectoryServices.AccountManagement

I'm trying to integrate a system with Active Directory using the System.DirectoryServices.AccountManagement stuff. Our IT people have setup an AD box and my dev box is not part of this (or any) domain.
So far, I have 3 lines of code as a test:
var pc = new PrincipalContext(ContextType.Domain, "machine", "CN=Administrator,CN=Users,DC=domain,DC=com", "Password");
var user = UserPrincipal.FindByIdentity(pc, IdentityType.SamAccountName, "Administrator");
var gp = GroupPrincipal.FindByIdentity(pc, IdentityType.SamAccountName, "Admins");
Creating the PrincipalContext works as listed above, but if I try to use the domain name instead of the server name then I get an error : The server could not be contacted. So, I left this on the machine name.
When getting the user or group, I get an error : A local error has occurred.
For the user, I also tried this with the same result:
var user = UserPrincipal.FindByIdentity(pc, IdentityType.DistinguishedName, "cn=Administrator,ou=users,dc=domain,dc=com");
So, overall, I'm confused :(
Does anyone have any suggestions?
As a side note, I'd like to kick the programmer who thought that 'a local error has occurred' would be a useful error message!
Cheers
PS: I can use the SysInternals AD Explorer just fine from my machine and I can see the dn's I'm trying to use.
PPS: If I use machine.domain.com for the name when creating the PrincipalContext, it also fails to connect.
So this is one of those things that makes perfect sense AFTER you hack through to the solution. The problem was the Context was trying to use a Negotiated security context which is not configured. When I used SimpleBind it works just fine:
var pc = new PrincipalContext(ContextType.Domain, "machine", "DC=domain,DC=com", ContextOptions.SimpleBind, "CN=Administrator,CN=Users,DC=domain,DC=com", "Password");
Cheers
PS: A more useful error message would have saved me a days head scratching!
To do the search using the credentials of the current user, specify the domain as such:
new PrincipalContext(ContextType.Domain, "xyz.mycorp.com:3268", "DC=mycorp,DC=com");
From
When do I need a Domain Name and a Domain Container to create a PrincipalContext?

Categories

Resources