Users login: Nested groups.

[Tomas Martinez]

Hi there!

If anyone could help me... thanks! My problem is this: our application
controls the users login with Active Directory. It checks that the user is
in
the groups we allow, but if one of these groups has a nested group in it,
the
user isn't checked in this last group (or others, if there were more nested
groups). How could we check users in nested groups?


Thanks a lot.

 

[Joe Kaplan \(MVP - ADSI\)]

If you use Windows authentication in IIS and ASP.NET, then the
WindowsPrincipal created by the runtime will do this for you. Otherwise,
you need to calculate them correctly somehow. If your AD domain is 2003
native mode and your server is a domain member, then you can use Kerberos
S4U to do this easily by creating a WindowsIdentity object using the user's
userPrincipalName attribute and using the resulting WindowsIdentity to
create a WindowsPrincipal.

If you absolutely have to use LDAP to get the user's group membership, I'd
suggest you use the tokenGroups attribute.
http://groups.google.com/groups?hl=en&lr=&[email protected]

Joe K.