Active Directory Object Navigator

• Download demo project - 23.1 Kb
• Download source - 351 Kb

Introduction

First of all, I want to introduce you to the problem that led me to this solution. I needed to authenticate against the Active Directory (AD) database, but found no object oriented way to do so. I found myself in a dead-end. How to use the Active Directory tree of objects in a way that didn't go against our 3-tier object oriented architecture.

So I decided I had to abstract the whole AD layer usage of my application. And to do so, I needed a framework that would allow me to navigate through AD objects as if they were an XML file (rough comparison I know!!!).

Background

I found out so many articles on how to get this property on AD, or how to get that property, but none really teaching how to use the LDAP language for instance. So I had a tough time trying to figure out how to reach an object via LDAP query.

Let me say that I do not intend to build an AD manager, and in my AD Object Navigator, I don't even allow you to change properties (although you could with the OriginalDirectoryEntry property).

My intention is to give you (the reader) a basic knowledge of how to use the AD database and a built framework for getting users, groups, containers and organizational units if you, like me, are planning on authenticating against an Active Directory database (and planning on using the AD user as the user for your application).

Using the code

I included with the source code (inside the Doc\ directory) a Windows HTML Help that explains on detail every class and function in the framework.

I commented the properties in the LoadUser function so it would load faster, but if you need more info about your users, just uncomment it or add other properties to it. Please let me know if it helped you and what you added.

The LoadUser method:

//C#
u = new Objects.User();
u.Id = de.NativeGuid;
u.UserName = getStringProperty(de.Properties,"sAMAccountName");
u.Email = getStringProperty(de.Properties,"userPrincipalName");
//u.GivenName = getStringProperty(de.Properties,"givenName");
u.OriginalDirectoryEntry = de;
if (de.Properties["useraccountcontrol"].Value != null)
{
    if (((int)de.Properties["useraccountcontrol"].Value & 2) == 0)
    {
        u.Enabled = true;
    }
    else
    {
        u.Enabled = false;
    }
}
else
{
    u.Enabled = false;
}
//u.AdditionalPhoneNumbers = 
//             getStringArrayProperty(de.Properties,"otherTelephone");
//u.AdditionalHomePages = getStringArrayProperty(de.Properties,"url");
//u.City = getStringProperty(de.Properties,"l");
//u.Country = getStringProperty(de.Properties,"c");
//u.Description = getStringProperty(de.Properties,"description");
u.DisplayName = getStringProperty(de.Properties,"displayName");
//u.HomePage = getStringProperty(de.Properties,"wWWHomePage");
//u.Initials = getStringProperty(de.Properties,"initials");
//u.PhysicalDeliveryOfficeName = 
//     getStringProperty(de.Properties,"physicalDeliveryOfficeName");
//u.PostOfficeBox = getStringProperty(de.Properties,"postOfficeBox");
//u.State = getStringProperty(de.Properties,"st");
//u.StreetAddress = getStringProperty(de.Properties,"streetAddress");
//u.TelephoneNumber = getStringProperty(de.Properties,"telephoneNumber");

The other thing you should know is that (for ease of use) I added three constants to the framework: DEFAULTDOMAIN, DEFAULTUSERNAME, DEFAULTPASSWORD. These constants are to be used with the framework functions so you won't have to pass them as parameters. Although they are used as the impersonate data, they could be set to nothing (I wouldn't recommend it though!). These constants are in the ADManager class.

#region Constants
    const string DEFAULTDOMAIN = "yourDomain";
    const string DEFAULTUSERNAME = "yourUserName";
    const string DEFAULTPASSWORD = "yourPassword";
#endregion

I'll explain the most common situations where you would like to be using this framework:

Authenticating an user against Active Directory:

'VB.NET
Public Function ValidateUser(ByVal username as _
          string, ByVal password as string) as boolean
  Dim u as BVA.ActiveDirectory.Navigator.Objects.User = _
     BVA.ActiveDirectory.Navigator.Business.AdManager.GetUser(username,password)
  return (u is nothing)
End Function

//C#
public bool ValidateUser(string username, string password)
{
  BVA.ActiveDirectory.Navigator.Objects.User u = 
    BVA.ActiveDirectory.Navigator.Business.AdManager.GetUser(username,password);
  return (u==null);
}

Getting the groups that an user is a member of:

'VB.NET
Public Function MemberShips(ByVal username as string, _
      ByVal password as string) as _
      BVA.ActiveDirectory.Navigator.Objects.GroupCollection
  Dim u as BVA.ActiveDirectory.Navigator.Objects.User = _
    BVA.ActiveDirectory.Navigator.Business.AdManager.GetUser(username,password)
  return u.MemberOf
End Function

//C#
public BVA.ActiveDirectory.Navigator.Objects.GroupCollection 
                MemberShips(string username, string password)
{
  BVA.ActiveDirectory.Navigator.Objects.User u =
    BVA.ActiveDirectory.Navigator.Business.AdManager.GetUser(username,password);
  return (u.MemberOf);
}

Getting the users in a determined group:

(SID is a unique ID that every AD object has in the AD database.)

'VB.NET
Public Function Members(ByVal SID as String) as _
          BVA.ActiveDirectory.Navigator.Objects.UserCollection
  Dim g as BVA.ActiveDirectory.Navigator.Objects.Group = _
    BVA.ActiveDirectory.Navigator.Business.AdManager.GetGroup(SID)
  return g.Members
End Function

//C#
public BVA.ActiveDirectory.Navigator.Objects.GroupCollection 
                                          Members(string SID)
{
  BVA.ActiveDirectory.Navigator.Objects.Group g = 
     BVA.ActiveDirectory.Navigator.Business.AdManager.GetGroup(SID)
  return (g.Members);
}

And there are many more applications for this framework like getting all users in the domain, checking to see if a user account is enabled, retrieving all the users in a determined organizational unit, and many more. Explore the code.

I have provided a demo application that shows the entire Active Directory tree.

Points of Interest

One thing that is really great about this framework is that it is completely loaded on-demand.

This means that all collections are loaded only when you need them. This is great because the Active Directory database isn't really fast, so you really wouldn't want to load the entire tree every time you want to access a user, for instance.

I.e.: let's say you have an Organizational Unit Users and then inside it you have an Organizational Unit Support and inside Support you have user TestUser. When you get the root node, it doesn't load the Users Organizational Unit. It only loads it when you access root.OrganizationalUnits. Then it loads all child nodes for the root node (including our Users node). Then when you access UsersNode.OrganizationalUnits, it loads all child nodes for the Users Organizational Unit node (including our Support node). And so on.

Another thing that would really add to this framework (and I didn't have the time to implement it, even though I would like to do it a lot) is adding caching to it, so when you get one node you already got before, it would use the cached version.

History

V 1.0 - AD Object Navigator released.

To-Do's

Caching the objects in the framework.