Hi Jerry,
Sorry for the late reply. Since I'm not dedicated to AD development I need
to communicate with other specialists to get some helpful information.
First the parameters used in the constructor method of PrincipalContext are
incorrect.It would be better to use following method:
PrincipalContext context = new
PrincipalContext(ContextType.Domain,"ad.DdGroup.com", _UserName, _Password);
It's a coincidence that what we tried initially happens to work (due to the
string build in the method internal). However, this is not supported like
this.
Secondly, about this exception, the GetAuthorizationGroups function
actually uses the AuthZ APIs underneath to build the group list. The AuthZ
api requires access to read certain attributes from AD. See this note from
MSDN for the AuthZ API. ( error 5 is ACCESS_DENIED )
Important Applications should not assume that the calling context has
permission to use this function. The AuthzInitializeContextFromSid function
reads the tokenGroupsGlobalAndUniversal attribute of the SID specified in
the call to determine the current user's group memberships. If the user's
object is in Active Directory, the calling context must have read access to
the tokenGroupsGlobalAndUniversal attribute on the user object. Read access
to the tokenGroupsGlobalAndUniversal attribute is granted to the
Pre-Windows 2000 Compatible Access group, but new domains contain an empty
Pre-Windows 2000 Compatible Access group by default because the default
setup selection is Permissions compatible with Windows 2000 and Windows
Server 2003. Therefore, applications may not have access to the
tokenGroupsGlobalAndUniversal attribute; in this case, the
AuthzInitializeContextFromSid function fails with ACCESS_DENIED.
Applications that use this function should correctly handle this error and
provide supporting documentation. To simplify granting accounts permission
to query a user's group information, add accounts that need the ability to
look up group information to the Windows Authorization Access Group.
http://msdn.microsoft.com/en-us/library/aa376309(VS.85).aspx
Are you running the code through a web browser? Can the same code work in a
WinForm application or when debugging this site in Visual Studio? Please
check if current user running the process has been added to the Windows
Authorization Access Group.
Please let me know if you made any progress on this issue.
Regards,
Allen Chen
Microsoft Online Support
--------------------
| Thread-Topic: System.DirectoryServices GetAuthorizationGroups() function
Er
| thread-index: AclEyTpuGzAipJmhTI+vAAYsZSwPgg==
| X-WBNR-Posting-Host: 207.46.193.207
| From: =?Utf-8?B?SmVycnkgQw==?= <
[email protected]>
| References: <
[email protected]>
<
[email protected]>
| Subject: RE: System.DirectoryServices GetAuthorizationGroups() function
Er
| Date: Wed, 12 Nov 2008 05:19:01 -0800
| Lines: 86
| Message-ID: <
[email protected]>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.3168
| Newsgroups: microsoft.public.dotnet.framework.aspnet
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.dotnet.framework.aspnet:79727
| NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
| X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
|
| Allen,
|
| Thank you for the reply.
|
| Here is the error page:
|
| While trying to retrieve the authorization groups, an error (5) occurred.
| Description: An unhandled exception occurred during the execution of the
| current web request. Please review the stack trace for more information
about
| the error and where it originated in the code.
|
| Exception Details:
| System.DirectoryServices.AccountManagement.PrincipalOperationException:
While
| trying to retrieve the authorization groups, an error (5) occurred.
|
| Source Error:
|
|
| Line 281: {
| Line 282: UserPrincipal p =
| UserPrincipal.FindByIdentity(context,IdentityType.SamAccountName,
username);
| Line 283: var groups = p.GetAuthorizationGroups();
| Line 284: //var groups = p.GetGroups();
| Line 285: foreach (GroupPrincipal group in groups)
|
|
| Source File:
| c:\Inetpub\wwwroot\CDActiveDirectory\App_Code\CSCode\ADRoleProvider.cs
| Line: 283
|
| Stack Trace:
|
|
| [PrincipalOperationException: While trying to retrieve the authorization
| groups, an error (5) occurred.]
| System.DirectoryServices.AccountManagement.AuthZSet..ctor(Byte[]
userSid,
| NetCred credentials, ContextOptions contextOptions, String
flatUserAuthority,
| StoreCtx userStoreCtx, Object userCtxBase) +1355
|
|
System.DirectoryServices.AccountManagement.ADStoreCtx.GetGroupsMemberOfAZ(Pr
incipal p) +220
|
|
System.DirectoryServices.AccountManagement.UserPrincipal.GetAuthorizationGro
upsHelper() +50
|
|
System.DirectoryServices.AccountManagement.UserPrincipal.GetAuthorizationGro
ups() +22
| CDMem.Roles.ADRoleProvider.GetRolesForUser(String username) in
| c:\Inetpub\wwwroot\CDActiveDirectory\App_Code\CSCode\ADRoleProvider.cs:283
|
| [ProviderException: Unable to query Active Directory.]
| CDMem.Roles.ADRoleProvider.GetRolesForUser(String username) in
| c:\Inetpub\wwwroot\CDActiveDirectory\App_Code\CSCode\ADRoleProvider.cs:305
| UserGroup.LoadUsersGroups(String UserId, String RoleProvider) in
| c:\inetpub\wwwroot\CDActiveDirectory\App_Code\VBCode\UserGroup.vb:113
| UserMaintenance.LoadUser() in
| c:\inetpub\wwwroot\CDActiveDirectory\UserMaintenance.aspx.vb:656
| UserMaintenance.ddlUsers_SelectedIndexChanged(Object sender, EventArgs
e)
| in c:\inetpub\wwwroot\CDActiveDirectory\UserMaintenance.aspx.vb:1737
| System.Web.UI.WebControls.ListControl.OnSelectedIndexChanged(EventArgs
e)
| +111
| System.Web.UI.WebControls.DropDownList.RaisePostDataChangedEvent() +134
|
|
System.Web.UI.WebControls.DropDownList.System.Web.UI.IPostBackDataHandler.Ra
isePostDataChangedEvent() +10
| System.Web.UI.Page.RaiseChangedEvents() +165
| System.Web.UI.Page.ProcessRequestMain(Boolean
| includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1485
|
|
|
|
----------------------------------------------------------------------------
----
| Version Information: Microsoft .NET Framework Version:2.0.50727.3053;
| ASP.NET Version:2.0.50727.3053
| --
|
| Maybe I am using the incorrect syntax for the domain;
| I am using :
| "10.13.1.11/DC=ad,DC=DdGroup,DC=com"
|
| What syntax are you using.
|
|
| Thank you
|
|
| Jerry
|
|
|
