Choosing an API for AD-based authorization in a Windows app

Question

We are building a rich-client app (WPF) that uses the logged-on user information for auditing and authorization.

I'm trying to decide between three different APIs for accessing this information:

• System.Management classes (WMI queries)
• System.Security.Principal classes (WindowsIdentity, etc)
• System.DirectoryServices.AccountManagement classes (UserPrincipal, etc)

The use cases are:

• Get the current username
• Get all the users in group X
• Get all the groups the current user belongs to
• Is the current user in group X?
• Is user X in group Y?

I have some proofs of concept for each method, but I'd like some objective reasons to use one or other. I'd appreciate facts on the following aspects:

• Testability
• Performance
• Ease of use
• Ease of deployment
  • In test/production
  • In developer's computers

Answer 1

WMI
is nice regarding testability because there are many (native/.NET/script...) out there whcih can be used for the same tasks, result comparison etc. What in my experience can be rather difficult is deployment/setup regarding security/communication etc.

System.DirectoryServices.AccountManagement
In my exeperience very easy to use and deploy... for developer's computer you can (sacrificing some subtler aspects) use the same code and test it with the local User/Groups if need be. Regarding Performance this is usually more than sufficient but can be tweaked a bit depending of you needs (ad-hoc AD queries versus permanent conn etc.). Should there ever be the need to not only query but create/change Users/Groups etc. this is an easy thing to do...

I didn't use System.Security.Principal alot so can't say much about it... the more current part of .NET is System.DirectoryServices.AccountManagement and works really well :-)