c# - Global catalog says that user from DomainA belongs to Domain Users from DomainB -
i trying detailed information user's group membership using directory services queries global catalog. don't want use getauthorizationgroups()
because it's flaky.
there 2 domains: domaina , domainb. global catalog server domain controller domainb. finally, there user (usera) part of domaina.
i find usera in global catalog , @ tokengroups
property sids of groups usera belongs.
to great surprise, find domainb\domain users
included in list. why being included, given usera not part of domainb?
here code i'm running:
using (directoryentry gc = new directoryentry("gc:")) { string userprincipalname = "usera@domaina.local"; directoryentry searchroot = null; gc.authenticationtype = system.directoryservices.authenticationtypes.secure; // there 1 child under "gc:". foreach (directoryentry de in gc.children) { searchroot = de; break; } using (searchroot) { searchresult samresult; using (var samsearcher = new directorysearcher()) { // find user. samsearcher.searchroot = searchroot; samsearcher.filter = "(userprincipalname=" + userprincipalname + ")"; samsearcher.propertiestoload.add("distinguishedname"); samresult = samsearcher.findone(); } list<byte[]> tokengroups; using (directoryentry theuser = samresult.getdirectoryentry()) { theuser.refreshcache(new string[] { "tokengroups" }); tokengroups = theuser.properties["tokengroups"].cast<byte[]>().tolist(); identityreferencecollection irc = new identityreferencecollection(tokengroups.count); foreach (byte[] groupsidbytes in tokengroups) { irc.add(new securityidentifier(groupsidbytes, 0)); } list<string> groupnames = irc.translate(typeof(ntaccount), true) .cast<ntaccount>() .select(a => a.value.tostring()) .tolist(); return groupnames; } } }
Comments
Post a Comment