如何验证Windows用户？

Question

我使用以下代码来验证属于我们公司域的用户。这很好用。

using (var entry = new DirectoryEntry(""))
{
    DirectorySearcher ds = new DirectorySearcher(entry);

    ds.Filter = "(|(&(objectCategory=user)(name=domainuser)))";
    ds.PropertyNamesOnly = true;
    ds.PropertiesToLoad.Add("name");
    ds.ReferralChasing = ReferralChasingOption.None;

    SearchResultCollection src = ds.FindAll();

    bool isValid = false;
    try
    {
        foreach (SearchResult sr in src)
        {
            DirectoryEntry de = sr.GetDirectoryEntry();
            de.Password = "domainpassword";
            object nativeObject = de.NativeObject;


            if (nativeObject != null)
                isValid = true;

            break;
        }
    }
    catch (DirectoryServicesCOMException ex) {}

    return isValid;
} 

实际问题是我需要在笔记本电脑 (MYINSTANCE) 中创建一个 LDAP 实例，然后需要以编程方式创建用户。我能够创建用户并迭代他们。

现在，对于此类用户，我无法验证用户名和密码。

我所做的更改如下。

using (var entry = new DirectoryEntry("LDAP://MYPC:389/CN=MYINSTANCE,DC=COMPANYDOMAIN,DC=com", "domainuser", "domainpassword", AuthenticationTypes.Secure))
{
    DirectorySearcher ds = new DirectorySearcher(entry);

    ds.Filter = "(|(&(objectCategory=user)(name=instanceuser)))";
    ds.PropertyNamesOnly = true;
    ds.PropertiesToLoad.Add("name");
    ds.ReferralChasing = ReferralChasingOption.None;

    SearchResultCollection src = ds.FindAll();

    bool isValid = false;
    try
    {
        foreach (SearchResult sr in src)
        {
            DirectoryEntry de = sr.GetDirectoryEntry();
            de.Password = "instancepassword";
            object nativeObject = de.NativeObject;


            if (nativeObject != null)
                isValid = true;

            break;
        }
    }
    catch (DirectoryServicesCOMException ex) {}

    return isValid;
} 

Answer 1

如果您使用 .NET 3.5 或更高版本，则可以使用 System.DirectoryServices.AccountManagement 命名空间并轻松验证您的凭据：

// create a "principal context" - e.g. your domain (could be machine, too)
using(PrincipalContext pc = new PrincipalContext(ContextType.Domain, "MYINSTANCE", 
                                "CN=MYINSTANCE,DC=COMPANYDOMAIN,DC=com", 
                                ContextType.SecureSocketLayer,
                                "domainuser", "domainpassword")
{
    // validate the credentials
    bool isValid = pc.ValidateCredentials("myuser", "mypassword");
}

它简单、可靠，它是 100% C# 托管代码 - 什么你还能要求更多吗？ :-)

在这里阅读所有相关内容：

• 管理 .NET Framework 3.5 中的目录安全主体
• MSDN 文档System.DirectoryServices.AccountManagement