Question

I have a function that retrieves the fullname of a user based on user name and domain. This function runs in ASP.NET thread under an impersonated user. When I use Directory searcher on a remote AD branch, I believe I m getting the SID number instead of the property (cannot verify it occurs on a different box).

public string GetUserFullName(string userName, string domainName)
{  
    DirectoryEntry rootEntry = new DirectoryEntry("GC://dc=company,dc=net");
    string filter = string.Format("(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(userPrincipalName={0}@{1}.company.net))", userName, domainName);
    DirectorySearcher searcher = new DirectorySearcher(rootEntry, filter, new string[] { "displayName" });
    rootEntry.AuthenticationType = AuthenticationTypes.Secure;
    searcher.PageSize = 1000;
    searcher.ServerTimeLimit = new TimeSpan(0, 10, 0);
    searcher.ReferralChasing = ReferralChasingOption.All;
    searcher.Asynchronous = false;

    SearchResult result = searcher.FindOne();
    if (result != null)
    {
        return (string) result.Properties["displayName"][0];
    }
    else
    {
        throw new Exception("Active Directory could not resolve your user name");
    }

}

Answer 1

您使用的是哪个版本的.NET框架？在.NET 3.5中，AD部分已进行了相当大的改进，并且现在提供了强类型的构造器，用于User和Groups等内容。

请访问MSDN上由我的朋友Joe Kaplan和Ethan Wilansky撰写的精彩文章“在.NET Framework 3.5中管理目录安全性原则”。确实是非常好的东西。

首先，您可以获取一个名为UserPrincipal的类，该类是强类型的，例如您的对象上的所有基本属性都是属性。确实非常有帮助。

其次，您可以通过PrincipalSearcher获得一个很好的“按示例查询”方法-请查看Joe和Ethan的文章中的此示例：

// create a principal object representation to describe
// what will be searched 
UserPrincipal user = new UserPrincipal(adPrincipalContext);

// define the properties of the search (this can use wildcards)
user.Enabled = false;
user.Name = "user*";

// create a principal searcher for running a search operation
PrincipalSearcher pS = new PrincipalSearcher();

// assign the query filter property for the principal object 
// you created
// you can also pass the user principal in the 
// PrincipalSearcher constructor
pS.QueryFilter = user;

// run the query
PrincipalSearchResult<Principal> results = pS.FindAll();

Console.WriteLine("Disabled accounts starting with a name of  user :");
foreach (Principal result in results)
{
    Console.WriteLine("name: {0}", result.Name);
}

如果有机会的话，请尝试使用.NET 3.5来处理你的AD事务！

马克

Answer 2

我将AD包装成一个方便的助手库，并始终使用此方法：

    /// <summary>
    /// Returns AD information for a specified userID.
    /// </summary>
    /// <param name="ntID"></param>
    /// <returns></returns>
    public ADUser GetUser(string ntID)
    {          
        DirectorySearcher search = new DirectorySearcher();        

        search.Filter = String.Format("(cn={0})", ntID);

        search.PropertiesToLoad.Add("mail");
        search.PropertiesToLoad.Add("givenName");
        search.PropertiesToLoad.Add("sn");
        search.PropertiesToLoad.Add("displayName");
        search.PropertiesToLoad.Add("userPrincipalName");
        search.PropertiesToLoad.Add("cn");

        SearchResult result = search.FindOne();

        return new ADUser(result);
    }

ADUser是一个自定义类，将SearchResult映射为强类型属性。

我不确定您的具体问题是什么，但这对我一直有效。

编辑: 对比我们的代码，我发现你没有告诉搜索预加载属性...这可能是你的问题。

友情链接