Develop Reference

Using AD group names stored in sql database for authorizing users in C# app

I have been sitting for this question so long and could not find an answer for it anywhere, however I know many companies are using what I want to do so I decided to put it on here.
What I would like to do is:
Store Windows users and/or AD groups in my database, assigning them to roles in the application. Of course these roles will be linked in my database to the user or group.
For a user, this is easy because you already have the user name when he/she logs in.
I want to find out in my app if the user belongs to any of the AD groups stored in my database and assign his/her permissions accordingly.
So here's an example:
I know my user has an entry in my database user/groups table: I know he is in the AD group called "MyAppGroup\MyDomain".
What is the easiest way to find out from my list of groups in the database to find out a user is in it?

As mentioned in the comments, the data you are looking for is already stored in Active Directory; you don't need to add it to your database at all.
You can query AD (including group membership and a ton of other data) using the System.DirectoryServices.AccountManagement API.
Here's a small example of how to retrieve the groups that a user is a member of:
using System.DirectoryServices.AccountManagement;
// ...
public List<string> GetGroupsForUser(string domain, string ou, string samAccountName)
{
var groups = new List<string>();
using (var principalContext = new PrincipalContext(ContextType.Domain, domain, ou))
using (var userPrinicpal = UserPrincipal.FindByIdentity(principalContext,
IdentityType.SamAccountName, samAccountName))
{
if (userPrinicpal == null)
return null;
foreach (var securityGroup in userPrinicpal.GetAuthorizationGroups())
groups.Add(securityGroup.DisplayName);
}
return groups;
}

How to make an exe file openable only by logging in an auth form

I need help to protect a very private tool that accepts followers on Instagram, I want to make the exe openable only if the user has logins credentials to prevent people from leaking it. I only have the .exe file and it's CMD line based, I wonder if we could like make an auth form in C# and then bind it to the .exe file
Thanks

Hard coded info:
The most simple scenario is just asking about credentials when starting the tool -> i.e. hard-coded username and password.
Active directory (or local PC) data:
other more professional option is to read the data from active directory (I do not know the environment you are working in), for example check if this user belongs to a specific group, the code will look like this:
// set up domain context
PrincipalContext ctx = new PrincipalContext(ContextType.Domain, "DOMAINNAME");
// find a user
UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");
// find the group in question
GroupPrincipal group = GroupPrincipal.FindByIdentity(ctx, "YourGroupNameHere");
if(user != null)
{
// check if user is member of that group
if (user.IsMemberOf(group))
{
// do something.....
}
}
The code above is taken from this answer.

C# get groups that a user is a member of in Active Directory

I'm not a programmer by nature so I apologize in advance :) I'm using the code snippets from http://www.codeproject.com/Articles/18102/Howto-Almost-Everything-In-Active-Directory-via-C#39 and it has been really helpful. I'm using his method for getting user group memberships and it requires his AttributeValuesMultiString method as well. I don't have any syntax errors but when I call the Groups method via Groups("username", true) I get the following error:
An unhandled exception of type 'System.Runtime.InteropServices.COMException' occurred in System.DirectoryServices.dll
I have done some digging but nothing seems to really answer why I'm getting this error.

You should check out the System.DirectoryServices.AccountManagement (S.DS.AM) namespace. Read all about it here:
Managing Directory Security Principals in the .NET Framework 3.5
MSDN docs on System.DirectoryServices.AccountManagement
Basically, you can define a domain context and easily find users and/or groups in AD:
// set up domain context
using (PrincipalContext ctx = new PrincipalContext(ContextType.Domain))
{
// find a user
UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");
if(user != null)
{
// get the user's groups
var groups = user.GetAuthorizationGroups();
foreach(GroupPrincipal group in groups)
{
// do whatever you need to do with those groups
}
}
}
The new S.DS.AM makes it really easy to play around with users and groups in AD!

ASPX C# Search for a User in Active Directory

Does anyone know the best way to search for a single user within Active Directory using DirectoryServices? I have code that currently lists all sub 'OU's' under a given LDAP path but I now want to add the feature of searching for a user under the path too. Could the code just be adapted to search for users?
I have included my code that lists all users in the current OU:
DirectoryEntry Ldap = new DirectoryEntry("LDAP://" + ouselect.SelectedValue + ";" + LDAPRoot, LDAPUser, LDAPPass);
DirectorySearcher ad_search = new DirectorySearcher(Ldap);
ad_search.Filter = "(objectClass=User)";
ad_search.SearchScope = SearchScope.Subtree;
ad_search.PropertiesToLoad.Add("samaccountname");
Any pointer that anyone can offer would be excellent.

If you're on .NET 3.5 and up, you should check out the System.DirectoryServices.AccountManagement (S.DS.AM) namespace. Read all about it here:
Managing Directory Security Principals in the .NET Framework 3.5
MSDN docs on System.DirectoryServices.AccountManagement
Basically, you can define a domain context and easily find users and/or groups in AD:
// set up domain context
using (PrincipalContext ctx = new PrincipalContext(ContextType.Domain))
{
// find a user
UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");
if(user != null)
{
// do something here....
}
}
The new S.DS.AM makes it really easy to play around with users and groups in AD!
PS: the PrincipalContext has a number of different overloads for its constructor - you can also define a username/password to use to query Active Directory, and you can also define a "starting" container, if you need to. Check out the MSDN documentation for details on this.

Your code is almost there. Just change your filter to search for a particular AD Attribute, rather than all users.
ad_search.Filter = string.Format("(department={0})", department);
ad_search.Filter = string.Format("(displayName={0})", "James Doe");
ad_search.Filter = string.Format("(sAMAccountName={0})", "some.username");

How to include multiple OU from AD account in a single search using PrincipleSearcher in asp.net c#

Scenario: Active Directory username search should return results against a search item (i.e. Firstname or Surname). There are 6 countries that are setup as different organizational units for AD accounts. e.g. UK (OU= UK), France (OU = FR). Now user should be displayed with a username which may belong to either OU=UK or OU=FR.
I am using PrincipalSearcher from System.DirectoryServices.AccountManagement library
PrincipalContext ctx = new PrincipalContext(ContextType.Domain, "myDomain",
"OU=UK,dc=comp,dc=com");
Problem: The above allows to return usernames which only belongs to OU=UK.
Question: How can I add multiple Organizational Units in PrincipalContext.

Try change the base object to OU=UK,OU=FR,DC=dc,DC=sys.... it might work,
Please look at the following link for details
http://ldapmaven.com/2011/07/27/mastering-ldapsearch/
EDIT :
It seems like it is not possible, please look at the following SO link,
LDAP root query syntax to search more than one specific OU