10

I am using ASP.Net 4.0 MVC to query active directory. I am trying to get a list of a user's group memberships and that iterate through them. I am having a weird problem. To get the groups I was using:

   PrincipalSearchResult<Principal> groups = up.GetGroups();

Which worked great on localhost but returns an empty set when moved to IIS6. So I tried using this:

    PrincipalSearchResult<Principal> groups = up.GetAuthorizationGroups();

Which worked great on IIS6 but returns an empty set on localhost. What is the difference between these 2 methods? Why can I use one in IIS6 and not on localhost? Why can I use the other one on localhost and not in IIS6?

2
  • 2
    The main difference between ´GetGroups´ and ´GetAuthoriazationGroups´: ´GetGroups´returns only the groups of which the principal is directly a member; no recursive searches are performed. But ´GetAuthorizationGroups´ returns nested groups (e.g: User1 > Group1 > Group2: User1 is indirectly member of Group2 because Group1 is member of Group2. The Method ´GetGroups´ not returns Group2).
    – Simon
    Aug 9, 2018 at 13:21
  • Neither solution posted worked for me, so I ended up just working with AD directly using the DirectoryEntry class. Sep 10, 2019 at 14:58

2 Answers 2

10

The why part has been answered, but this may help someone wanting to know the functional difference between the two methods. From MS documentation:

GetGroups - Returns a collection of group objects that specify the groups of which the current principal is a member.

This overloaded method only returns the groups of which the principal is directly a member; no recursive searches are performed.

GetAuthorizationGroups - Returns a collection of principal objects that contains all the authorization groups of which this user is a member. This function only returns groups that are security groups; distribution groups are not returned.

This method searches all groups recursively and returns the groups in which the user is a member. The returned set may also include additional groups that system would consider the user a member of for authorization purposes.

So GetGroups gets all groups of which the user is a direct member, and GetAuthorizationGroups gets all authorization groups of which the user is a direct or indirect member.

Despite the way they are named, one is not a subset of the other. There may be groups returned by GetGroups not returned by GetAuthorizationGroups, and vice versa.

7

I assume GetAuthorizationGroups() calls in to tokenGroups in AD. To read that, your service account (or IIS machine account if Network Service) needs to be in the Windows Authorization Access group in AD.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.