Search for Global Domain at Active Directory

Question

If I have the following AD domains path:

AD Paths :

• LDAP://AAA.CORP.XX.COM
• LDAP://BBB.CORP.XX.COM
• LDAP://CCC.BBB.CORP.XX.COM
• LDAP://DDD.CORP.XX.COM
• LDAP://EEE.CORP.XX.COM
• LDAP://FFF.CORP.XX.COM

I need to search in the above domains for user if exist in one of them or not .

My current solution:

I looped via all domains above and for each domain I check if the user existed or not and at one of domains above it took from 6-7 seconds and the rest took less than 1 second.

Proposed solutions to enhance performance:

1. Try to search for user in the parent domain that should be LDAP://CORP.XX.COM so It will save number of searching instead of 5 searches for each domain to be 1 search for parent domain
2. Try to use the "Global Catalog" ==> I need guid here (tutorial with C# code)

Which solution is better to enhance performance issue ?

Answer 1

If you're using .NET 3.5 or newer, you should be able to use a PrincipalSearcher and a "query-by-example" principal to do your searching:

// create your domain context
// here, you could also include a specific domain, if needed
PrincipalContext ctx = new PrincipalContext(ContextType.Domain);

// define a "query-by-example" principal - here, we search for a UserPrincipal 
UserPrincipal qbeUser = new UserPrincipal(ctx);

// if you're looking for a particular user - you can limit the search by specifying
// e.g. a SAMAccountName, a first name - whatever criteria you are looking for
qbeUser.SamAccountName = "johndoe";

// create your principal searcher passing in the QBE principal    
PrincipalSearcher srch = new PrincipalSearcher(qbeUser);

// find all matches
foreach(var found in srch.FindAll())
{
    // do whatever here - "found" is of type "Principal" - it could be user, group, computer.....          
}

You can specify any of the properties on the UserPrincipal and use those as "query-by-example" for your PrincipalSearcher. This is a lot easier than using the older DirectorySearcher approach.

If you haven't already - absolutely read the MSDN article Managing Directory Security Principals in the .NET Framework 3.5 which shows nicely how to make the best use of the new features in System.DirectoryServices.AccountManagement

Answer 2

Here is a Class that I wrote and used at several places look thru the methods to see what you can use..

using System;
using System.Text;
using System.Collections;
using System.DirectoryServices;
using System.Diagnostics;
using System.Data.Common;

namespace Vertex_VVIS.SourceCode
{
    public class LdapAuthentication
    {
        private String _path;
        private String _filterAttribute;

        public LdapAuthentication(String path)
        {
            _path = path;
        }
 public bool IsAuthenticated(String domain, String username, String pwd)
        {
            String domainAndUsername = domain + @"\" + username;
            DirectoryEntry entry = new DirectoryEntry(_path, domainAndUsername, pwd);

            try
            {   //Bind to the native AdsObject to force authentication.         
              //  Object obj = entry.NativeObject;

                DirectorySearcher search = new DirectorySearcher(entry);

                search.Filter = "(SAMAccountName=" + username + ")";
                search.PropertiesToLoad.Add("cn");
                SearchResult result = search.FindOne();

                if (null == result)
                {
                    return false;
                }

                //Update the new path to the user in the directory.
                _path = result.Path;
                _filterAttribute = (String)result.Properties["cn"][0];
            }
            catch (Exception ex)
            {
                throw new Exception("Error authenticating user. " + ex.Message);
            }

            return true;
        }

        public String GetName(string username)
        {

            String thename = null;

            try
            {
                DirectoryEntry de = new DirectoryEntry(_path);
                DirectorySearcher ds = new DirectorySearcher(de);
                ds.Filter = String.Format("(SAMAccountName={0})", username);
                ds.PropertiesToLoad.Add("displayName");
                SearchResult result = ds.FindOne();
                if (result.Properties["displayName"].Count > 0)
                {
                    thename = result.Properties["displayName"][0].ToString();
                }
                else
                {
                    thename = "NA";
                }
            }
            catch (Exception ex)
            {
                throw new Exception("Error Getting Name. " + ex.Message);
            }

            return thename.ToString();
        }

        public String GetEmailAddress(string username)
        {
            String theaddress = null;
            try
            {
                DirectoryEntry de = new DirectoryEntry(_path);
                DirectorySearcher ds = new DirectorySearcher(de);
                ds.Filter = String.Format("(SAMAccountName={0})", username);
                ds.PropertiesToLoad.Add("mail");
                SearchResult result = ds.FindOne();
                theaddress = result.Properties["mail"][0].ToString();
                de.Close();
            }
            catch (Exception ex)
            {
                throw new Exception("Error Getting Email Address. " + ex.Message);
            }

            return theaddress.ToString();
        }
        public String GetTitle(string username)
        {
            String thetitle = null;
            try
            {
                DirectoryEntry de = new DirectoryEntry(_path);
                DirectorySearcher ds = new DirectorySearcher(de);
                ds.Filter = String.Format("(SAMAccountName={0})", username);
                ds.PropertiesToLoad.Add("title");
                SearchResult result = ds.FindOne();
                result.GetDirectoryEntry();
                if (result.Properties["title"].Count > 0)
                {
                    thetitle = result.Properties["title"][0].ToString();
                }
                else
                {
                    thetitle = "NA";
                }
            }
            catch (Exception ex)
            {
                throw new Exception("Error Getting the Title. " + ex.Message);
            }

            return thetitle.ToString();
        }

        public String GetPhone(string username)
        {
            String thephone = null;
            try
            {
                DirectoryEntry de = new DirectoryEntry(_path);
                DirectorySearcher ds = new DirectorySearcher(de);
                ds.Filter = String.Format("(SAMAccountName={0})", username);
                ds.PropertiesToLoad.Add("mobile");
                SearchResult result = ds.FindOne();
                result.GetDirectoryEntry();
                if (result.Properties["mobile"].Count > 0)
                {
                    thephone = result.Properties["mobile"][0].ToString();
                }
                else
                {
                    thephone = "NA";
                }
            }
            catch (Exception ex)
            {
                throw new Exception("Error Getting Phone Number. " + ex.Message);
            }

            return thephone.ToString();
        }

        public String GetGroups()
        {
            DirectorySearcher search = new DirectorySearcher(_path);
           search.Filter = "(cn=" + _filterAttribute + ")";
           search.PropertiesToLoad.Add("memberOf");
            StringBuilder groupNames = new StringBuilder();

            try
            {
                SearchResult result = search.FindOne();

                int propertyCount = result.Properties["memberOf"].Count;

                String dn;
                int equalsIndex, commaIndex;

                for (int propertyCounter = 0; propertyCounter < propertyCount; propertyCounter++)
                {
                    dn = (String)result.Properties["memberOf"][propertyCounter];

                    equalsIndex = dn.IndexOf("=", 1);
                    commaIndex = dn.IndexOf(",", 1);
                    if (-1 == equalsIndex)
                    {
                        return null;
                    }

                    groupNames.Append(dn.Substring((equalsIndex + 1), (commaIndex - equalsIndex) - 1));
                    groupNames.Append("|");

                }
            }
            catch (Exception ex)
            {
                throw new Exception("Error obtaining group names. " + ex.Message);
            }
            return groupNames.ToString();
        }

        public bool IsUserGroupMember(string strUserName, string strGroupString)
        {
            bool bMemberOf = false;
            ResultPropertyValueCollection rpvcResult = null; 
            try
            {
                DirectoryEntry de = new DirectoryEntry(_path);
                DirectorySearcher ds = new DirectorySearcher(de);
                ds.Filter = String.Format("(SAMAccountName={0})", strUserName);
                ds.PropertiesToLoad.Add("memberOf");
                SearchResult result = ds.FindOne();
                string propertyName = "memberOf";  
                rpvcResult = result.Properties[propertyName];  

                foreach (Object propertyValue in rpvcResult)  
                 {
                     if (propertyValue.ToString().ToUpper() == strGroupString.ToUpper())
                     {  
                         bMemberOf = true;
                         break;
                     }  
                 }  
            }
            catch (Exception ex)
            {
                throw new Exception("Error Getting member of. " + ex.Message);
            }

            return bMemberOf;

        }
    }
}

Answer 3

I answered a similary question (Can I match a user to a group accross different domains) and the answer is close to @Marc_s, but at the end of the answer you can see where to place the domain.