trying to search in System.DirectoryServices.AccountManagement to find AD user with pager field contains a string

Question

I'm trying to search using the System.DirectoryServices.AccountManagement library in c#. The goal is to find an AD user with the pager field containing a string.

For example, if I have .pager = "F1234b!@" I need to find a user who's pager field contains "1234".

I can't figure out how to search the contents of the pager field in s.ds.am to contain a string.

@Joel, I assume Eric is providing a generic example where he wants to search both before and after a specific character string. — J Weezy, Mar 08 '18 at 16:39

score 2 · Answer 1 · answered Mar 08 '18 at 17:44

If you want to experiment with S.DS.AM, try using this method. Put a breakpoint at the return listPrincipal line and inspect each of the principal variables for what they contain.

private static List<Principal> GetPrincipalList (string strPropertyValue, string strDomainController)
        {
            List<Principal> listPrincipal = null;
            Principal principal = null;
            GroupPrincipal groupPrincipal = null;
            UserPrincipal userPrincipal = null;
            ComputerPrincipal computerPrincipal = null;
            PrincipalSearchResult<Principal> listPrincipalSearchResult = null; // Groups
            PrincipalContext principalContext = null;
            ContextType contextType;
            IdentityType identityType;

            try
            {
                // Setup a UserPrincipal list.
                listPrincipal = new List<Principal>();

                // Set the contextType to Domain because we are going through the AD directory store.
                contextType = ContextType.Domain;

                // Setup a domain context.
                principalContext = new PrincipalContext(contextType, strDomainController);

                // Setup the IdentityType. This is required, otherwise you will get a MultipleMatchesException error that says "Multiple principals contain a matching Identity."
                // This happens when you have two objects that AD thinks match whatever you're passing to UserPrincipal.FindByIdentity(principalContextDomain, strPropertyValue)
                // Use IdentityType.Guid because GUID is unique and never changes for a given object.                   
                identityType = IdentityType.Guid;

                // Find user.
                principal = Principal.FindByIdentity(principalContext, identityType, strPropertyValue);
                groupPrincipal = GroupPrincipal.FindByIdentity(principalContext, identityType, strPropertyValue);
                userPrincipal = UserPrincipal.FindByIdentity(principalContext, identityType, strPropertyValue);
                computerPrincipal = ComputerPrincipal.FindByIdentity(principalContext, identityType, strPropertyValue);

                // Return the listPrincipal list.
                return listPrincipal;
            }
            finally
            {
                // Cleanup objects.
                listPrincipal = null;
                listPrincipalSearchResult = null;
                principalContext = null;
                groupPrincipal = null;
                userPrincipal = null;
                computerPrincipal = null;
            }
        }

J Weezy · Accepted Answer · 2018-03-12T20:07:09.147

Use the * character as a wildcard. For example, in the filter criteria for DirectoryEntry, you can use the following:

(&(objectCategory=person)(objectClass=user)(pager=*1234*))

https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx

https://msdn.microsoft.com/en-us/library/ms679102(v=vs.85).aspx

Also, be careful using S.DS.AM. I know it provides a lot of useful functionality, but it is much slower than S.DS.AD.

Active Directory: The Principal Class - S.DS.AM vs S.DS.AD

Update: Keep in mind that Microsoft introduced the following classes in the S.DS.AM namespace wrapper:

UserPrincipal
ComputerPrincipal
GroupPrincipal

https://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement.principal.aspx

Study the inheritance hierarchy and inspect the properties/attributes that are available - WYSWIG. If the attribute that you want to search for is not included then you will not be able to use S.DS.AM - you will need to use S.DS.AD.

The * wildcard still stands when searching for properties that are available within the Principal class that contain specific character strings.

A useful post when searching on available properties in S.DS.AM: search by samaccountname with wildcards

Update 2:

I ran across the following post on SO that might be useful for what you are trying to do: How to get Active Directory Attributes not represented by the UserPrincipal class

It's not the answer I'm looking for as it's not using s.ad.am, it's using the old school s.da.ad stuff, or if it is using .am, it's not a compete solution. As the answer will work with s.ds.ad, even though that' s not what I asked for I gave it an upvote for effort. I'm deliberately trying to learn .AM after using AD. Thanks! — Eric Brown - Cal, Mar 08 '18 at 17:00
That won't work because pager is not a property of the UserPrincipal class. See the following weblink for properties that are made available within the UserPrincipal class. https://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement.userprincipal.aspx — J Weezy, Mar 08 '18 at 17:09

trying to search in System.DirectoryServices.AccountManagement to find AD user with pager field contains a string

2 Answers2