C# desktop access active directory groups

Question

I have a C# 2010 desktop application where I have code setup to see if a user is a member of an active directory group. I am using WindowsIdentity to check the current users active directory group level. The following code is not working. Thus can you tell me how to what is wrong with the code below?

If you think the code listed below will not work, can you tell me how you would modify the code listed below?

If you do no see anything wrong, can you tell me what to suggest to the network people at my company to suggest to them what is wrong?

using ActiveDirectoryCommon;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Windows.Forms;
using System.Collections.Specialized;
using System.Deployment.Application;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.Remoting;
using System.IO;
using System.Web;
using System.Configuration; // required to obtain the values from the
ConfigurationManager.Appsettings in the app.config file
using System.Security.Principal;
using System.Threading;

namespace File_Reject
{
    static class Program
    {
        /// <summary>
        internal static ActiveDirectoryUser CurUser;
        [STAThread]


        static void Main()
          {
              try
              {
              Application.EnableVisualStyles();
             Application.SetCompatibleTextRenderingDefault(false);
             CurUser = new ActiveDirectoryUser();
             if
(!Thread.CurrentPrincipal.IsInRole(Environment.UserDomainName + "\\" + ConfigurationManager.AppSettings["role_File_Upload"]))
              {
                MessageBox.Show("You do not have authortity to access File Transfer. Please contact your network administrator if you have any
questions.", "File Transfer Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
                      return;
                  }
                  Application.Run(new FileReject());
              }
                catch (Exception e)
              {
                  //console.write(e.Message);

              }

        }
    }
}
----------

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Diagnostics;
using System.Reflection;
using System.IO;
using System.Threading;
using System.Web;
using System.Windows.Forms;
using System.Security.Principal;

namespace ActiveDirectoryCommon
{
    public class ActiveDirectoryUser
    {
        public ActiveDirectoryUser()
        {

AppDomain.CurrentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal);
            Thread.CurrentPrincipal = new WindowsPrincipal(WindowsIdentity.GetCurrent());
        }
    }
}
-----------
<?xml version="1.0"?>
<configuration>

<appSettings>
    <add key="role_File_Upload" value="File_Upload" />
</appSettings>

</configuration>
------------

Scott Lysle · Answer

See if this does not help you out; works for me. using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.DirectoryServices; using System.DirectoryServices.AccountManagement; using System.DirectoryServices.ActiveDirectory; namespace Login.Utility { public class ActiveDirectorySecurity { /// /// Determine if user Id and password represent a valid Active Directory User /// This method assumes the execution is within the same domain as the tested /// user - not sure if this can always be relied upon so the next function /// performs the same test but allow passing in the domain name as an argument /// /// /// /// public static bool ValidateActiveDirUser(string userId string password) { PrincipalContext adContext = new PrincipalContext(ContextType.Domain); using (adContext) return adContext.ValidateCredentials(userId password); } /// /// Validate a user is a valid AD member in a specified domain /// /// Provide the user's user name (ID) /// Provide the user's password (plain text) /// Provide the user's domain name /// public static bool ValidateActiveDirDomainUser(string userId string password string domainName) { PrincipalContext prncContext = new PrincipalContext(ContextType.Domain domainName); using (prncContext) return prncContext.ValidateCredentials(userId password); } /// /// Determine the list of groups to which the user is a principal member /// /// /// public static List GetUsersGroups(string userId) { List usersGroups = new List (); PrincipalContext prncContext = new PrincipalContext(ContextType.Domain); UserPrincipal user = UserPrincipal.FindByIdentity(prncContext userId); if (user != null) { PrincipalSearchResult authorizedGroups = user.GetAuthorizationGroups(); foreach (Principal prince in authorizedGroups) { if (prince is GroupPrincipal) usersGroups.Add((GroupPrincipal)prince); } } return usersGroups; } public static List GetUserGroupNames(string userId) { List usersGroups = GetUsersGroups(userId); List returnGroups = new List (); foreach (GroupPrincipal p in usersGroups) returnGroups.Add(p.Name); return returnGroups; } /// /// Get a list of all of the users properties and their set values /// /// /// public static string GetUsersProperties(string userId) { StringBuilder sb = new StringBuilder(); PrincipalContext prncContext = new PrincipalContext(ContextType.Domain); UserPrincipal user = UserPrincipal.FindByIdentity(prncContext userId); if (user != null) { DirectoryEntry de = (user.GetUnderlyingObject() as DirectoryEntry); if (de != null) { foreach (string s in de.Properties.PropertyNames) sb.Append(s +  :  + de.Properties[s][0].ToString() + Environment.NewLine); } } return sb.ToString(); } /// /// Get a specific user's property value (if within the same domain) /// /// /// public static string GetUsersPropertyInformation(string userId string propertyName) { string result = string.Empty; PrincipalContext prncContext = new PrincipalContext(ContextType.Domain); UserPrincipal user = UserPrincipal.FindByIdentity(prncContext userId); if (user != null) { DirectoryEntry de = (user.GetUnderlyingObject() as DirectoryEntry); if (de != null) { if (de.Properties.Contains(propertyName)) result = de.Properties[propertyName][0].ToString(); } } return result; } /// /// Get a specific user's property value if outside the domain /// /// /// /// public static string GetDomainUsersPropertyValue(string userId string propertyName string domainName) { string result = string.Empty; PrincipalContext prncContext = new PrincipalContext(ContextType.Domain domainName); UserPrincipal user = UserPrincipal.FindByIdentity(prncContext userId); if (user != null) { DirectoryEntry de = (user.GetUnderlyingObject() as DirectoryEntry); if (de != null) { if (de.Properties.Contains(propertyName)) result = de.Properties[propertyName][0].ToString(); } } return result; } /// /// Provides a list of actual domains which may be used to control /// domain options provided in the UI if such are needed /// /// public static List GetDomainList() { List domainList = new List (); Forest currentForest = Forest.GetCurrentForest(); foreach (GlobalCatalog gc in currentForest.GlobalCatalogs) domainList.Add(gc.Name); return domainList; } } }