代码之家 › 专栏 › 技术社区 › JohnFx

如何确定广告组是否包含来自其他(受信任)域的给定目录条目?

adsi ldap active-directory .net

3

JohnFx · 技术社区 · 16 年前

我正在努力充实我的代码,以确定用户是否是给定广告组的成员。它基本上可以工作,除非该组的成员碰巧来自另一个(受信任)域,因为它存储为ForeignSecurityPrincipal。

考虑到我对要测试的组和要检查的帐户都有一个有效的DirectoryEntry对象,我需要一个DirectorySearch筛选器字符串,该字符串允许我确认帐户在该组中,即使该帐户是ForeignSecurityPrincipal。

(演示该问题的vb.net代码示例)

Dim ContainerGroup as DirectoryEntry = ... Code to get Group
Dim UserToCheckFor as DirectoryEntry = ... Code to get User

DSearcher = New DirectorySearcher(ContainerGroup, "(WHATCANIPUTINHERE)", New String() {"member;Range=0-5000"}, SearchScope.Base)
DSearcher.AttributeScopeQuery = "member"

'If an object is found, the account was in the group
Return (DSearcher.FindOne() IsNot Nothing)

1 回复 | 直到 15 年前

1

JohnFx 16 年前

可以。找到它了。这就是诀窍。

我正在努力充实我的代码,以确定用户是否是给定广告组的成员。它基本上可以工作,除非该组的成员碰巧来自另一个(受信任)域,因为它存储为ForeignSecurityPrincipal。

(vb.net代码示例)

Dim ContainerGroup as DirectoryEntry = ... Code to get Group
Dim UserToCheckFor as DirectoryEntry = ... Code to get User

DSearcher = New DirectorySearcher
Dim DSearcher As New DirectorySearcher(ContainerGroup, getLDAPQueryStringUsingSID(containedGroup), New String() {"member;Range=0-5000"}, SearchScope.Base)

Return (DSearcher.FindOne() IsNot Nothing) 


** Helper Methods **

Private Function getLDAPQueryStringUsingSID(ByVal DEObject As DirectoryEntry) As String            
  Return "(objectSid=" + getSDDLSidForDirectoryEntry(DEObject) + ")"
End Function

Private Function getSDDLSidForDirectoryEntry(ByVal DEObject As DirectoryEntry) As String
      Dim bytes As Byte() = CType(DEObject.Properties("objectSid").Value, Byte())
      Dim sid As New System.Security.Principal.SecurityIdentifier(bytes, 0)
      Return sid.ToString
End Function