Re: Problem in Accessing Active Directory from ASP.net

We cover this type of stuff in great detail in our book, but here are a few
pointers.

First, you may not need to use LDAP at all to get the user's groups. If you
are using Windows auth in IIS (IWA, Basic or Digest), then ASP.NET already
"knows" the users group via the WindowsIdentity and WindowsPrincipal objects
in Context.User. Just call IsInRole to access the Groups property.

If you really do need to access AD using the authenticated user's
credentials and you are using IWA for authentication, then you'll need to
enable Kerberos delegation. You also may need to provide a domain hint in
your path as serverless binding may not work the way you want to. Simply
put the DNS domain name in your path:

LDAP://yourdomain.com/DC=yourdomain,DC=com

instead of

LDAP://DC=yourdomain,DC=com

Getting Kerberos delegation working will likely be the more tricky part.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Maqsood Ahmed [MCAD .NET]" <Maqsood Ahmed [MCAD
..NET]@discussions.microsoft.com> wrote in message
news:83414C48-4438-407E-A200-30F8F27D2C24@xxxxxxxxxxxxxxxx
Environment:
Windows XP, .NET/ASP .NET 2.0

I am developing an intranet application for my company. I want to use LDAP
to get the existing users of the company and allow them access according
to
their roles. I have set identity impersonation = true and authentication
mode
= "Windows" in the Web.config file of the application.

I get an COMException whenever I try to access LDAP objects using the
DirectoryEntry class. It only happens when I use it through IIS. it works
fine with ASP .NET Development Server. Please note that I am using
Serverless
binding.
The exception message is like the following:
System.Runtime.InteropServices.COMException (0x8007054B): The specified
domain either does not exist or could not be contacted.

[Code]
DirectoryEntry de = new DirectoryEntry();
string domainName = de.Name; //This line generates exception
[/Code]

I have also tried to assign a domain account as the Anonymous account for
the Virtual Direcotry, but it didn't help either.
Can anyone of you please let me know that what should I do to get it
working. Should I always provide the domain name, username and password to
access the LDAP objects, can't it be used via anonymous access?


.

Relevant Pages

  • Re: Active Directory and Roles
    ... I think he is using the Active Directory membership provider in ASP.NET 2.0 ... corresponding LDAP method to build roles as well (unless he can use protocol ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... What did you mean by windows impersonation? ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Problem in Accessing Active Directory from ASP.net
    ... your path as serverless binding may not work the way you want to. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... Windows XP, .NET/ASP .NET 2.0 ... I get an COMException whenever I try to access LDAP objects using the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authenticating LDAP connection with current windows users credentials?
    ... setup and theory behind an ldap ... The Kerberos only works with ADS right now but that is sufficient for your situation. ... when the user has logged in interactively and therefore has a valid Kerberos ticket cached in Windows logon credential cache. ... CallbackHandler callbackHandler = new KerbCallback; ...
    (comp.lang.java.programmer)
  • can not log into a windows machine connected to a domain managed by samba/ldap
    ... by samba to create the entry in ldap when a machine joins the domain ... I have changed "smb.conf" so it calls a personal script instead of ... Once the this problem has been solved, I could not log into the windows ...
    (Debian-User)
  • Re: How do I convert sid retrieved from the AD to SDDL string form
    ... LDAP doesn't support joins. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... objectSid property to a SecurityIdentifier class. ...
    (microsoft.public.dotnet.security)