How to get the current user's Active Directory details in C#

Question

I am working on an C# and ASP.Net application, that uses Windows Authentication.

i.e. in Web.config:

<system.web>
    <authentication mode="Windows" />
</system.web>

I want to get details for the current user (full name, email address, etc) from Active Directory.

I can get their pre Windows 2000 user login name (eg: SOMEDOMAIN\someuser) by using

string username = HttpContext.Current.Request.ServerVariables["AUTH_USER"];

I've worked out the LDAP query for the user, using their current login name (not their pre Windows 2000 user login name):

DirectorySearcher adSearch = new DirectorySearcher(
        "(userprincipalname=someuser@somedomain.com.au)");
SearchResult adSearchResult = adSearch.FindOne();

However, I don't know how to either search AD for the user using their pre W2K login name, or get their login name in the 'someuser@somedomain.com.au' format.

Any ideas?

Alan · Accepted Answer · 2013-05-06T06:44:54.867

55

The "pre Windows 2000" name i.e. DOMAIN\SomeBody, the Somebody portion is known as sAMAccountName.

So try:

using(DirectoryEntry de = new DirectoryEntry("LDAP://MyDomainController"))
{
   using(DirectorySearcher adSearch = new DirectorySearcher(de))
   {
     adSearch.Filter = "(sAMAccountName=someuser)";
     SearchResult adSearchResult = adSearch.FindOne();
   }
}

someuser@somedomain.com.au is the UserPrincipalName, but it isn't a required field.

edited May 06 '13 at 06:44

answered Mar 12 '09 at 05:53

Alan

45,915
17
113
134

8

No, it's not. The sAMAccountName does not contain the "DOMAIN\" portion, making it useless for forest-wide queries. – Chris KL Jul 20 '11 at 01:15
Indeed, the lack of "DOMAIN\" is problematic. – Jun 20 '12 at 00:17
Sorry, the comment didn't match the code sample. Yes the sAMAccountName is just the "username" portion of DOMAIN\username. sAMAccountName has no concept of forrest, because it's a pre Windows2000 concept. If you need to search a W2k+ domain forest, use the UPN `username@DOMAIN` – Alan May 06 '13 at 06:47

score 45 · Answer 2 · edited Apr 17 '14 at 21:04

Alan already gave you the right answer - use the sAMAccountName to filter your user.

I would add a recommendation on your use of DirectorySearcher - if you only want one or two pieces of information, add them into the "PropertiesToLoad" collection of the DirectorySearcher.

Instead of retrieving the whole big user object and then picking out one or two items, this will just return exactly those bits you need.

Sample:

adSearch.PropertiesToLoad.Add("sn");  // surname = last name
adSearch.PropertiesToLoad.Add("givenName");  // given (or first) name
adSearch.PropertiesToLoad.Add("mail");  // e-mail addresse
adSearch.PropertiesToLoad.Add("telephoneNumber");  // phone number

Those are just the usual AD/LDAP property names you need to specify.

score 11 · Answer 3 · answered Jun 16 '09 at 18:45

Add reference to COM "Active DS Type Library"

            Int32 nameTypeNT4               = (int) ActiveDs.ADS_NAME_TYPE_ENUM.ADS_NAME_TYPE_NT4;
            Int32 nameTypeDN                = (int) ActiveDs.ADS_NAME_TYPE_ENUM.ADS_NAME_TYPE_1779;
            Int32 nameTypeUserPrincipalName = (int) ActiveDs.ADS_NAME_TYPE_ENUM.ADS_NAME_TYPE_USER_PRINCIPAL_NAME;

            ActiveDs.NameTranslate nameTranslate = new ActiveDs.NameTranslate();

            // Convert NT name DOMAIN\User into AD distinguished name 
            // "CN= User\\, Name,OU=IT,OU=All Users,DC=Company,DC=com"
            nameTranslate.Set(nameTypeNT4, ntUser);

            String distinguishedName = nameTranslate.Get(nameTypeDN);

            Console.WriteLine(distinguishedName);

            // Convert AD distinguished name "CN= User\\, Name,OU=IT,OU=All Users,DC=Company,DC=com" 
            // into NT name DOMAIN\User
            ntUser = String.Empty;
            nameTranslate.Set(nameTypeDN, distinguishedName);
            ntUser = nameTranslate.Get(nameTypeNT4);
            Console.WriteLine(ntUser);

            // Convert NT name DOMAIN\User into AD UserPrincipalName Name.User@Company.com
            nameTranslate.Set(nameTypeNT4, ntUser);
            String userPrincipalName = nameTranslate.Get(nameTypeUserPrincipalName);

            Console.WriteLine(userPrincipalName);

The use of the NameTranslate to get the DSN is the right way. — Johannes Kuhn, May 13 '13 at 15:05
Hi, I try to do this, but when I add "Active DS Type Library" is maked with a yellow triangle like a warning. I'm in windows 10, do you know what happed? thanks — Lautaro Cozzani, Jun 15 '16 at 13:35

score 4 · Answer 4 · answered Apr 15 '11 at 04:52

If you're using .NET 3.5 SP1+ the better way to do this is to take a look at the

System.DirectoryServices.AccountManagement namespace.

It has methods to find people and you can pretty much pass in any username format you want and then returns back most of the basic information you would need. If you need help on loading the more complex objects and properties check out the source code for http://umanage.codeplex.com its got it all.

Brent

How to get the current user's Active Directory details in C#

4 Answers4

Linked