Check active directory group membership recursively

问题

So I have a question regarding recursive groups in active directory. I have a little method that checks if a user id is in a group or not. Works great. Found out today that it doesn't check recursive group membership and I'm not too sure how (or if) there is a way to do that. Here's what I have so far for non-recursive:

public static bool CheckGroupMembership(string userID, string groupName, string Domain)
{
  bool isMember = false;

  PrincipalContext ADDomain = new PrincipalContext(ContextType.Domain, Domain);
  UserPrincipal user = UserPrincipal.FindByIdentity(ADDomain, userID);

  if (user.IsMemberOf(ADDomain, IdentityType.Name, groupName.Trim()))
  {
    isMember = true;
  }

  return isMember;
}

I've seen some things about a directory searcher or something but I'm somewhat new to working directly with AD and while I understand the concepts, some other things are still a little lost on me.

Thanks!

回答1:

Here is a solution using System.DirectoryServices.AccountManagement Namespace. It's a kind of recursive solution. In Find Recursive Group Membership (Active Directory) using C#, I give a recursive solution that also works with distribution groups.

/* Retreiving a principal context
 */
Console.WriteLine("Retreiving a principal context");
PrincipalContext domainContext = new PrincipalContext(ContextType.Domain, "WM2008R2ENT:389", "dc=dom,dc=fr", "jpb", "PWD");


/* Look for all the groups a user belongs to
 */
UserPrincipal aUser = UserPrincipal.FindByIdentity(domainContext, "user1");
PrincipalSearchResult<Principal> a =  aUser.GetAuthorizationGroups();

foreach (GroupPrincipal gTmp in a)
{
  Console.WriteLine(gTmp.Name);    
}

回答2:

You can also check by using the recursive option of GroupPrincipal.GetMembers.

public static bool CheckGroupMembership(string userID, string groupName, string Domain) {
    bool isMember = false;

    PrincipalContext ADDomain = new PrincipalContext(ContextType.Domain, Domain);
    UserPrincipal user = UserPrincipal.FindByIdentity(ADDomain, userID);
    GroupPrincipal group = GroupPrincipal.FindByIdentity(ADDomain, groupName);

    if ((user != null) && (group != null)) {
        isMember = group.GetMembers(true).Contains(user);
    }

    return isMember;
}

来源：https://stackoverflow.com/questions/10145781/check-active-directory-group-membership-recursively