7

I would like to get a user's group memberships in an ActiveDirectory, without being in the domain. When I run this inside the domain, all is well.

var context = new PrincipalContext(ContextType.Domain);
var principal = UserPrincipal.FindByIdentity(context, IdentityType.Name, "administrator");

foreach (var authorizationGroup in principal.GetAuthorizationGroups())
{
    Console.WriteLine(authorizationGroup.Name);
}

However, when I run outside the domain, I have to specify the PrincipalContext lie this:

var context = new PrincipalContext(ContextType.Domain, "10.0.1.255", "DC=test,DC=ad,DC=be", "administrator", "password");

When I run this code, I get an exception when I execute principal.GetAuthorizationGroups(). The exception I get is:

System.DirectoryServices.AccountManagement.PrincipalOperationException: Information about the domain could not be retrieved (1355).
at System.DirectoryServices.AccountManagement.Utils.GetDcName(String computerName, String domainName, String siteName, Int32 flags)
at System.DirectoryServices.AccountManagement.ADStoreCtx.LoadDomainInfo()
at System.DirectoryServices.AccountManagement.ADStoreCtx.get_DnsDomainName()
at System.DirectoryServices.AccountManagement.ADStoreCtx.GetGroupsMemberOfAZ(Principal p)
at System.DirectoryServices.AccountManagement.UserPrincipal.GetAuthorizationGroupsHelper()
at System.DirectoryServices.AccountManagement.UserPrincipal.GetAuthorizationGroups()

3 Answers 3

4

Looks like a DNS problem.

DC locator works by doing DNS queries for SRV records to find the appropriate DC in your current site. If that stuff isn't in DNS, DC locator will fail, which is happening in your stack trace.

1
  • I had this issue. Running "nslookup yourdomain" should resolve to your DC.
    – T3hc13h
    Jan 4, 2013 at 21:34
2

I just had to deal with same problem. I hope this help someone else.

/*Argument*/
string username;



/*Global settings*/
string ADHost = "dc.a.b.c"; /*Or ip address*/
string ADUsername = "username";
string ADPassword = "password";
string ADDomain = "a.b.c";
string ADContainer = "DC=A,DC=B,DC=C"; /*I have a function to do the translation*/
/*Global settings*/

var list = new List<string>();

var path = "LDAP://" + ADHost + "/" + ADContainer;
var deDomain = new DirectoryEntry(path, ADUsername, ADPassword);
var ds = new DirectorySearcher(deDomain, "(&(objectClass=User)(sAMAccountName=" + username + "))");

ds.SearchScope = SearchScope.Subtree; /*Cascade*/
ds.ReferralChasing = ReferralChasingOption.All; /*Follow redirection*/

var usr = ds.FindOne();
if (null != usr)
{
    var deUsr = new DirectoryEntry(usr.Path, ADUsername, ADPassword);

    foreach (string groupDN in deUsr.Properties["memberOf"])
    {
        string[] parts = groupDN.Replace("CN=", "").Split(',');
        list.Add(parts[0]);
    }
}
0

It might be that, I can't verify it right now.

I tried the following: I use sysinternals' excellent Active DirectoryExplorer. When logging in with the same credentials: 10.0.1.255, "administrator", "password"

Now I can see the user's groups without problems as

["memberOf"] = "CN=TestGroup,CN=Users,DC=test,DC=ad,DC=be"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.