當調用者不在域中時請求AD中的用戶角色

Question

我想在ActiveDirectory中獲取用戶的組成員身份，而不在域中。當我在域內運行時，一切都很好。

var context = new PrincipalContext(ContextType.Domain); 
var principal = UserPrincipal.FindByIdentity(context, IdentityType.Name, "administrator"); 

foreach (var authorizationGroup in principal.GetAuthorizationGroups()) 
{ 
    Console.WriteLine(authorizationGroup.Name); 
} 

然而，當我運行外域，我必須指定PrincipalContext在於這一點：

var context = new PrincipalContext(ContextType.Domain, "10.0.1.255", "DC=test,DC=ad,DC=be", "administrator", "password"); 

當我運行這段代碼，我得到一個異常，當我執行principal.GetAuthorizationGroups()。我得到的例外是：

System.DirectoryServices.AccountManagement.PrincipalOperationException: Information about the domain could not be retrieved (1355). 
at System.DirectoryServices.AccountManagement.Utils.GetDcName(String computerName, String domainName, String siteName, Int32 flags) 
at System.DirectoryServices.AccountManagement.ADStoreCtx.LoadDomainInfo() 
at System.DirectoryServices.AccountManagement.ADStoreCtx.get_DnsDomainName() 
at System.DirectoryServices.AccountManagement.ADStoreCtx.GetGroupsMemberOfAZ(Principal p) 
at System.DirectoryServices.AccountManagement.UserPrincipal.GetAuthorizationGroupsHelper() 
at System.DirectoryServices.AccountManagement.UserPrincipal.GetAuthorizationGroups() 

Answer 1

看起來像一個DNS問題。

DC定位器通過對SRV記錄執行DNS查詢以在當前站點中查找適當的DC來工作。如果這些東西不在DNS中，則DC定位器將失敗，這發生在您的堆棧跟蹤中。

Answer 2

可能是這樣，我現在無法驗證它。

我嘗試了以下方法：我使用sysinternals的優秀Active Directory Explorer。當使用相同的憑據登錄：10.0.1.255, "administrator", "password"

現在我可以看到用戶的組沒有問題

["memberOf"] = "CN=TestGroup,CN=Users,DC=test,DC=ad,DC=be" 

Answer 3

我不得不處理同樣的問題。我希望這可以幫助別人。

/*Argument*/ 
string username; 



/*Global settings*/ 
string ADHost = "dc.a.b.c"; /*Or ip address*/ 
string ADUsername = "username"; 
string ADPassword = "password"; 
string ADDomain = "a.b.c"; 
string ADContainer = "DC=A,DC=B,DC=C"; /*I have a function to do the translation*/ 
/*Global settings*/ 

var list = new List<string>(); 

var path = "LDAP://" + ADHost + "/" + ADContainer; 
var deDomain = new DirectoryEntry(path, ADUsername, ADPassword); 
var ds = new DirectorySearcher(deDomain, "(&(objectClass=User)(sAMAccountName=" + username + "))"); 

ds.SearchScope = SearchScope.Subtree; /*Cascade*/ 
ds.ReferralChasing = ReferralChasingOption.All; /*Follow redirection*/ 

var usr = ds.FindOne(); 
if (null != usr) 
{ 
    var deUsr = new DirectoryEntry(usr.Path, ADUsername, ADPassword); 

    foreach (string groupDN in deUsr.Properties["memberOf"]) 
    { 
     string[] parts = groupDN.Replace("CN=", "").Split(','); 
     list.Add(parts[0]); 
    } 
}