CODEWITHSUNDEEP
c#active-directoryldap
Jack
Jack

Reputation: 181

How to write a Cross Forest LDAP Query in C#?

I'm trying to write an efficient LDAP Query that returns results from another Forest/Domain. There is not a two-way trust in place. There are not conditional forwarders in place. What I do have is a verified network connection, an IP address and a service account and password to use.

This is the basic LDAP code I usually use.

        DirectoryEntry deParent = new DirectoryEntry("LDAPS://000.0.000.00/DC=bob,DC=earl,DC=john,DC=whatever");
        deParent.Username = "Domain\\UserName";
        deParent.Password = "Password";
        deParent.AuthenticationType = AuthenticationTypes.Secure;            
        DirectorySearcher ds = new DirectorySearcher(deParent, qry, columns, SearchScope.Subtree);

I know this is a little broad spectrum, but there's a lot of conflicting information out there. So.

  1. Is a trust REQUIRED to perform a cross forest query? Query only, no login except for the service account.
  2. Will a basic DirectoryEntry call like above work?
  3. Can anyone please provide an example of a working cross forest query in c#?

Upvotes: 0

Views: 3721

Answers (2)

Jack
Jack

Reputation: 181

1.Is a trust REQUIRED to perform a cross forest query? Query only, no login except for the service account.

No, a trust isn't required to perform a cross forest query.

2.Will a basic DirectoryEntry call like above work? Not even a little bit. The standard Directory Entry method would/might work if appropriate trusts were involved.

3.Can anyone please provide an example of a working cross forest query in c#? This Method works.

And This has more information.

and just in case, if you don't have a dns entry for the forests FQDN, just update your HOSTS file to point it in the right place.

And even more information. If your Search Request is extremely slow (~48-60 seconds), be sure to turn referral chasing OFF! 

    connection.SessionOptions.ReferralChasing = ReferralChasingOptions.None;

Upvotes: 1

Brian Desmond
Brian Desmond

Reputation: 4503

So is there an error? Your combination of LDAPS and an IP is likely a problem as the certificate won be valid. I'd expect also in this case that your AuthN type should be Basic instead.

Upvotes: 0

Related Questions