CODEWITHSUNDEEP
c#active-directoryldapdirectoryservices
Bob Tway
Bob Tway

Reputation: 9613

Active Directory: find details of users in group without mass search

OK, working with active directory, my one remaining requirement is to pull back all the users in a given group and get their details - first name, last name, username, email.

Having read up around this I was surprised to discover that there doesn't seem to be a way of doing this in an efficient fashion. I've worked out two ways of getting the results, but both seem absurdly wasteful.

The first is to search members of a group, like this:

        DirectoryEntry searchRoot = new DirectoryEntry("LDAP://" + server, username, password);
        DirectorySearcher search = new DirectorySearcher(searchRoot);
        search.Filter = string.Format("(|(CN={0})(CN={1}))", "Group1", "Group2");

        search.PropertiesToLoad.Add("member");
        SearchResultCollection results = search.FindAll();

Which brings back a single result containing usernames, and usernames only. You can dissect this into an array of individual usernames, but then to get the details of each user you have to search AD again on a per-name basis.

The other approach is to do this:

   DirectoryEntry searchRoot = new DirectoryEntry("LDAP://" + server, username, password);
    DirectorySearcher search = new DirectorySearcher(searchRoot);
    search.Filter = string.Format("(&(&(objectClass=user)(objectCategory=person))(memberOf=*))");

    search.PropertiesToLoad.Add("memberOf");
    search.PropertiesToLoad.Add("name");
    search.PropertiesToLoad.Add("mail");
    search.PropertiesToLoad.Add("displayName");

    SearchResultCollection mySearchResultColl = search.FindAll();

    foreach (SearchResult result in mySearchResultColl)
    {
        foreach (string prop in result.Properties["memberOf"])
        {
            if (prop.Contains("Group1") || prop.Contain("Group2"))
            {
               //add user to list
            }
        }
    }

Which gets me what I want but involves retrieving every active directory user and then iterating through the collection to find ones that match. That works fine on my little test directory, but I shudder to think how slow it's going to be on a system with thousands of users.

I'm aware you can do what I need using the PrinicpalContext object, but as best I can tell that only works if the code is running in the same domain, which I can't guarantee. I need to be able to query across domains.

Is there a better way of doing this? Or am I just going to have to suck on the performance issues?

Upvotes: 4

Views: 3477

Answers (2)

baldpate
baldpate

Reputation: 1749

If you only need to find direct members, you can use Attribute Scope Query (ASQ). This requires domain/forest functional level of 2003 (forgot domain or forest).

DirectoryEntry groupEntry = new DirectoryEntry("LDAP://<server>/<group DN>", "user", "pwd");

DirectorySearcher searcher = new DirectorySearcher(groupEntry);
searcher.SearchScope = SearchScope.Base;
searcher.AttributeScopeQuery = "member";
searcher.Filter = "(&(objectCategory=person)(objectClass=user))";
searcher.PropertiesToLoad.Clear();
searcher.PropertiesToLoad.Add("name");
searcher.PropertiesToLoad.Add("mail");
searcher.PropertiesToLoad.Add("displayName");

foreach (SearchResult result in searcher.FindAll())
{
    Console.WriteLine(result.Path);
}

For nested group members, you may use the LDAP_MATCHING_RULE_IN_CHAIN matching rule. This requires domain/forest functional level of 2008 R2 (again, forgot domain or forest).

DirectoryEntry rootEntry = new DirectoryEntry("GC://<server>", "user", "pwd");

DirectorySearcher searcher = new DirectorySearcher(rootEntry);
searcher.SearchScope = SearchScope.Subtree;
searcher.Filter = "(&(objectCategory=person)(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=<group DN>))";
searcher.PropertiesToLoad.Clear();
searcher.PropertiesToLoad.Add("name");
searcher.PropertiesToLoad.Add("mail");
searcher.PropertiesToLoad.Add("displayName");

foreach (SearchResult result in searcher.FindAll())
{
    Console.WriteLine(result.Path);
}

Limitations:

  • Both methods don't handle primary group membership
  • ASQ don't work across domain, an exception will be thrown if member from another domain is found. So normally you can only perform this for global groups.

Upvotes: 2

Damien
Damien

Reputation: 1478

You could utilize an ANR search for some of those attributes For more information, see this article - the functionality has been there since 2000:

http://support.microsoft.com/kb/243299

In order to search for other attributes not in the default set, you'd need to tweak the schema (which may not be suitable in your situation).

Upvotes: 0

Related Questions