如何從Active Directory獲取用戶的密碼到期日期？

Question

我已經使用LDAP在ASP.NET MVC 5中實現了Active Directory身份驗證。我想知道如何獲得用戶的

1. 帳戶鎖定（布爾）
2. 密碼過期（布爾）
3. 密碼到期日期（日期時間）

這是我當前的代碼：

using System.Web.Mvc; 
using System.Web.Security; 
using MvcApplication.Models; 

[HttpPost] 
public ActionResult Login(LoginModel model, string returnUrl) 
{ 
    if (!this.ModelState.IsValid) 
    { 
     return this.View(model); 
    } 

    if (Membership.ValidateUser(model.UserName, model.Password)) 
    { 
     FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe); 

     if (this.Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/") 
      && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\")) 
     { 
      return this.Redirect(returnUrl); 
     } 

     return this.RedirectToAction("Index", "Home"); 
    } 

    this.ModelState.AddModelError(string.Empty, "The user name or password provided is incorrect."); 

    return this.View(model); 
} 

public ActionResult LogOff() 
{ 
    FormsAuthentication.SignOut(); 

    return this.RedirectToAction("Index", "Home"); 
} 

Answer 1

我管理使用System.Web.Security和的System.DirectoryServices的組合來做到這一點。

public bool IsExpired(MembershipUser user, LoginModel model) 
{ 
    bool result = false; 

    string ldap = ConfigurationManager.ConnectionStrings["ADConnectionString"].ConnectionString; 

    DirectoryEntry rootEntry = new DirectoryEntry(ldap, model.UserName, model.Password, AuthenticationTypes.Secure); 

    DirectorySearcher mySearcher = new DirectorySearcher(rootEntry); 

    SearchResultCollection results; 
    string filter = "maxPwdAge=*"; 
    mySearcher.Filter = filter; 

    results = mySearcher.FindAll(); 
    long maxDays = 0; 
    if (results.Count >= 1) 
    { 
     Int64 maxPwdAge = (Int64)results[0].Properties["maxPwdAge"][0]; 
     maxDays = maxPwdAge/-864000000000; 
    } 

    long daysLeft = 0; 

    daysLeft = maxDays - DateTime.Today.Subtract(user.LastPasswordChangedDate).Days; 

    if (daysLeft <0) 
    { 
     result = true; 
    } else 
    { 
     if (daysLeft<=14) 
     { 
      this.Expiring = true; 
      this.ExpiringString = String.Format("You must change your password within" + " {0} days", daysLeft); 
     }  
     else 
     { 
      this.Expiring = false; 
     }  
    } 

    return result; 
} 

Answer 2

最簡單的方法是PInvoke LogonUser Win32 API.eg http://www.pinvoke.net/default.aspx/advapi32/LogonUser.html

讀也MSDN參考：https://msdn.microsoft.com/en-us/library/aa378184.aspx

你的問題的例子：https://www.codeproject.com/articles/18102/howto-almost-everything-in-active-directory-via-c