Check if User Is member of a group

Question

Hello,
I have a web service that checks if a user is a member of a group. I am not concerned if they are a direct member or an indirect member of a group, but if the user is in the group (or any of their groups is in the group) I need the method to return true. I know that I can use the IAdmGroup object to get a list of all members (direct and indirect) of the group but this service is going to be used quite a bit, and some of the groups could be very large (10,000+). I pulled the user object and used Groups() but it doesn't identify groups that the user is a nested member of. Is there a simple way to get a boolean response to if a user is a member of a group. Here is an example: User A is a member of group 2. Group 2 is a member of Group 1. My method needs to return true when I pass it User A and Group 1. I am using ADSI, c# (.Net 4.0), and WCF.

Answer 1

Hello,

We've updated our SDK with an example that shows how to get all groups a user is a member of (directly or indirectly). Take a look at the second example in the following article: http://www.adaxes.com/sdk/?SampleScript ... ember.html.

Comments

Here is the solution we came up with. Hope this helps someone else with a similar problem.

List<string> Groups = new List<string>();
            var admUser = (IAdmTop) user;
            var groups = (Object[]) admUser.MemberOf;
            foreach (byte[] bytes in groups)
            {
                Guid guid = new Guid(bytes);
                var group = GetGroup("Adaxes://<GUID=" + guid.ToString() + ">");
                var name = group.Name;
                if (group.Name.Contains("CN="))
                    name = group.Name.Replace("CN=", string.Empty);
                Groups.Add(name);

            }

---

Hello,

In your script, you get the group name by accessing the Name property of the IADs interface. The property returns the Relative Distinguished Name (RDN) of an AD object. An RDN consists of an attribute type and attribute value in the format <attribute_type>=<attribute_value>, for example CN=My Group. To get the name of an AD object without the attribute type, you need to get the Name property of the object. For this purpose, use the Get property of the IADs interface. For example, in your code:

List<string> Groups = new List<string>();
            var admUser = (IAdmTop) user;
            var groups = (Object[]) admUser.MemberOf;
            foreach (byte[] bytes in groups)
            {
                Guid guid = new Guid(bytes);
                var group = GetGroup("Adaxes://<GUID=" + guid.ToString() + ">");
                var name = group.Get("name");
                Groups.Add(name);
            }

---

Hi

No matter what, it coud be really cool to have a Adm-IsUserMember cmdlet in the next version of Adaxes 8-)

- Thanks