0

I am trying to connect to an Active Directory domain (W2K8R2 DC) in a different forest. To that end, I pass the credentials into the following DirectoryEntry constructor:

DirectoryEntry(string path, string username, string password, AuthenticationTypes authenticationType)

This is all good and well. What I would like to do though is retain the connection somehow and reuse it through all my calls to the AD so that I do not need to pass the credentials repeatedly. Is this possible somehow?

Thanks!

1
  • I just found out that System.DirectoryServices.AccountManagement contains functionality like that; this won't work for me though because I need to access arbitrary fields from the Active Directory.
    – Sleepless
    Feb 9, 2011 at 18:58

1 Answer 1

5

If you want the control at the connection level, I recommend you to use System.DirectoryServices.Protocol. You can reuse your LDAP connection to make different LDAP queries. However, the programming paradigm is very different from DirectoryEntry

If you need to use DirectoryEntry, you have to store the username and password somewhere and then pass them to all the DirectoryEntry objects. What I would do is to write a method GetDirectoryEntry(string dn) and have this method create the DirectoryEntry for me with the correct username and password. This doesn't look elegant but it doesn't do anything wrong. If you care password being stored in memory in plain text, use SecureString to store the password.

This is nothing wrong because DirectoryEntry is maintaining its own LDAP connection pool. If you have multiple DirectoryEntry with the same username and password, it will be smart enough to share the LDAP connection. It's basically the same as holding a single LDAP connection and doing different LDAP queries. It's not going to re-authenticate to LDAP server for each of the DirectoryEntry objects

If you don't like to rely on the black box feature from DirectoryEntry, the following suggested workaround may make you feel better.

static DirectoryEntry GetObject(DirectoryEntry root, string dn)
{
    using (DirectorySearcher searcher = new DirectorySearcher(root))
    {
        searcher.Filter = "(distinguishedName=" + dn + ")";
        searcher.SearchScope = SearchScope.Subtree;
        SearchResult result = searcher.FindOne();
        if (result == null) return null;
        return result.GetDirectoryEntry();
    }
}

You just need to bind to a root object with username and password. Then, you can keep the root object as a static variable or whatever you like. Then, you get another DirectoryEntry object by doing a LDAP query with the SearchRoot set to your root object. The returned DirectoryEntry will still use the username and password from root. Again, this is not doing anything better than simply passing in username and password to DirectoryEntry. Indeed, performance-wise, it's worse because we need to do one more LDAP query to get the DirectoryEntry

2
  • Great - this looks very feasable; I think I'll go for the DirectorySearcher method. Thank you very much for your excellent and detailled answer!
    – Sleepless
    Feb 10, 2011 at 9:03
  • This is beautiful. I needed to know if DirectoryEntry really was maintaining its own LDAP connection pool and if I should really be creating a new DirectoryEntry and associated DirectorySearcher every time I wanted to query the AD instead of having a singleton. This helped answer my question and refactor my code in confidence that the overhead in making the LDAP connection is only done once and all other DirectoryEntry instantiations utilize a connection pool functionality and avoid the LDAP connection overhead if possible. Thanks!
    – bradykey
    Mar 8, 2016 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.