CODEWITHSUNDEEP
c#network-programmingactive-directory
JD.
JD.

Reputation: 15551

Why do I need to set up trust to query Active Directory?

I am new to Active Directory and was given a task to fix a bug where a app on one of our servers could not access active directory on another server. The user we are using to bind to active directory is a "Domain Admin" and we are using this user's credentials in a C# application to access active directory with the System.DirectoryServices.AccountManagent classes of .net 3.5.

The server is in the same domain as the active directory server.

After struggling to make the app work, the network administrator set up trust (as a last resort) to the server computer (where the app is installed) and that allowed the app to work.

The network admin said :

"If I open the computer account in AD and click on Delegation (and then select 'Trust this computer for delegation to any service (Kerberos only)' it works!! I can't see why I should need to enable delegation for the server as it's already on the domain anyhow - but it works"

My question is why was this necessary?

Upvotes: 0

Views: 189

Answers (1)

makerofthings7
makerofthings7

Reputation: 61463

It sounds like a programming error where PrincipalContext isn't taking effect. None of these samples change the default service context... If he looks at the event logs he probably sees MachineName$ (dollar sign) logging in.

Try this - Set the service account name from LocalService to the account you want to use with LDAP. It should work, even without domain admin rights.

Upvotes: 1

Related Questions