從asp.net獲取AD用戶objectGuid的身份驗證

Question

我在ASP.NET應用程序中使用了Windows身份驗證。我想知道如何最好地從當前登錄的用戶獲取objectGuid？

問候，埃吉爾。

Answer 1

您可以使用System.DirectoryServices命名空間執行此操作。

Dim entry As DirectoryServices.DirectoryEntry 
Dim mySearcher As System.DirectoryServices.DirectorySearcher 
Dim result As System.DirectoryServices.SearchResult 
Dim myEntry As DirectoryEntry 
Dim domainName As String 
Dim userId As String 
Dim objectGuid As Guid 

'Split the username into domain and userid parts 
domainName = Page.User.Identity.Name.Substring(0, Page.User.Identity.Name.IndexOf("\")) 
userId = Page.User.Identity.Name.Substring(Page.User.Identity.Name.IndexOf("\") + 1) 

'Start at the top level domain 
entry = New DirectoryEntry(domainName) 

mySearcher = New DirectorySearcher(entry) 

'Build a filter for just the user 
mySearcher.Filter = ("(&(anr=" & userId & ")(objectClass=user))") 

'Get the search result ... 
result = mySearcher.FindOne 

'... and then get the AD entry that goes with it 
myEntry = result.GetDirectoryEntry 

'The Guid property is the objectGuid 
objectGuid = myEntry.Guid 

有可能是一個更好的方法來做到這一點，但這是有效的！

Answer 2

您需要使用NativeGuid屬性。 C＃代碼：

string login = HttpContext.Current.User.Identity.Name; 
string domain = login.Substring(0, login.IndexOf('\\')); 
string userName = login.Substring(login.IndexOf('\\') + 1); 
DirectoryEntry domainEntry = new DirectoryEntry("LDAP://" + domain); 
DirectorySearcher searcher = new DirectorySearcher(domainEntry); 
searcher.Filter = string.Format(
    "(&(objectCategory=person)(objectClass=user)(sAMAccountName={0}))", 
    userName); 
SearchResult searchResult = searcher.FindOne(); 
DirectoryEntry entry = searchResult.GetDirectoryEntry(); 
Guid objectGuid = new Guid(entry.NativeGuid); 

Answer 3

建議的解決方案相當昂貴。而不是由域和用戶名搜索，更好的解決方案是使用SID來查找帳戶：

// using System.Security.Principal; 
IPrincipal userPrincipal = HttpContext.Current.User; 
WindowsIdentity windowsId = userPrincipal.Identity as WindowsIdentity; 
if (windowsId != null) 
{ 
    SecurityIdentifier sid = windowsId.User; 

    using(DirectoryEntry userDe = new DirectoryEntry("LDAP://<SID=" + sid.Value + ">")) 
    { 
     Guid objectGuid = new Guid(userDe.NativeGuid); 
    } 
}