CODEWITHSUNDEEP
.netwindows-identityrbacwindows-principal
muratgu
muratgu

Reputation: 7311

How can I retrieve all the roles (groups) a user is a member of?

Is there a way to get a list of roles a Windows authenticated user is in, without explicitly checking by WindowsPrincipal.IsInRole method?

Upvotes: 32

Views: 29822

Answers (4)

philoroussel
philoroussel

Reputation: 113

If you are not connected to the domain server, the Translate function may throw the following exception The trust relationship between this workstation and the primary domain failed.

But for most of the groups, it will be OK, so I use:

foreach(var s in WindowsIdentity.GetCurrent().Groups) {
    try {
        IdentityReference grp = s.Translate(typeof (NTAccount)); 
        groups.Add(grp.Value);
    }
    catch(Exception) {  }
}

Upvotes: 7

DigitalDan
DigitalDan

Reputation: 2637

In an ASP.NET MVC site, you can do it like this:

Add this to your Web.config:

<system.web>
  ...
  <roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" />
  ...
</system.web>

Then you can use Roles.GetRolesForUser() to get all the Windows groups that the user is a member of. Make sure you're using System.Web.Security.

Upvotes: 1

joshperry
joshperry

Reputation: 42227

WindowsPrincipal.IsInRole just checks if the user is a member of the group with that name; a Windows Group is a Role. You can get a list of the groups that a user is a member of from the WindowsIdentity.Groups property.

You can get WindowsIdentity from your WindowsPrincipal:

WindowsIdentity identity = WindowsPrincipal.Identity as WindowsIdentity;

or you can get it from a factory method on WindowsIdentity:

WindowsIdentity identity = WindowsIdentity.GetCurrent();

WindowsIdenity.Groups is a collection of IdentityReference which just gives you the SID of the group. If you need the group names you will need to translate the IdentityReference into an NTAccount and get the Value:

var groupNames = from id in identity.Groups
                 select id.Translate(typeof(NTAccount)).Value;

Upvotes: 51

Steve Willcock
Steve Willcock

Reputation: 26839

EDIT: Josh beat me to it! :)

Try this

using System;
using System.Security.Principal;

namespace ConsoleApplication5
{
    internal class Program
    {
        private static void Main(string[] args)
        {
            var identity = WindowsIdentity.GetCurrent();

            foreach (var groupId in identity.Groups)
            {
                var group = groupId.Translate(typeof (NTAccount));
                Console.WriteLine(group);
            }
        }
    }
}

Upvotes: 9

Related Questions