How to validate windows user? - directoryentry

Question

I use the following code to validate the users who belong to our company domain. This works fine.
using (var entry = new DirectoryEntry(""))
{
DirectorySearcher ds = new DirectorySearcher(entry);
ds.Filter = "(|(&(objectCategory=user)(name=domainuser)))";
ds.PropertyNamesOnly = true;
ds.PropertiesToLoad.Add("name");
ds.ReferralChasing = ReferralChasingOption.None;
SearchResultCollection src = ds.FindAll();
bool isValid = false;
try
{
foreach (SearchResult sr in src)
{
DirectoryEntry de = sr.GetDirectoryEntry();
de.Password = "domainpassword";
object nativeObject = de.NativeObject;
if (nativeObject != null)
isValid = true;
break;
}
}
catch (DirectoryServicesCOMException ex) {}
return isValid;
}
The actual problem is that I need to create an LDAP instance in my laptop (MYINSTANCE) and then I need to create users programmatically. I'm able to create users and iterate through them.
Now for such users I'm not able to validate the user name and password.
The change I made was as below.
using (var entry = new DirectoryEntry("LDAP://MYPC:389/CN=MYINSTANCE,DC=COMPANYDOMAIN,DC=com", "domainuser", "domainpassword", AuthenticationTypes.Secure))
{
DirectorySearcher ds = new DirectorySearcher(entry);
ds.Filter = "(|(&(objectCategory=user)(name=instanceuser)))";
ds.PropertyNamesOnly = true;
ds.PropertiesToLoad.Add("name");
ds.ReferralChasing = ReferralChasingOption.None;
SearchResultCollection src = ds.FindAll();
bool isValid = false;
try
{
foreach (SearchResult sr in src)
{
DirectoryEntry de = sr.GetDirectoryEntry();
de.Password = "instancepassword";
object nativeObject = de.NativeObject;
if (nativeObject != null)
isValid = true;
break;
}
}
catch (DirectoryServicesCOMException ex) {}
return isValid;
}

Answer 1

If you work on .NET 3.5 or higher, you can use the System.DirectoryServices.AccountManagement namespace and easily verify your credentials:
// create a "principal context" - e.g. your domain (could be machine, too)
using(PrincipalContext pc = new PrincipalContext(ContextType.Domain, "MYINSTANCE",
"CN=MYINSTANCE,DC=COMPANYDOMAIN,DC=com",
ContextType.SecureSocketLayer,
"domainuser", "domainpassword")
{
// validate the credentials
bool isValid = pc.ValidateCredentials("myuser", "mypassword");
}
It's simple, it's reliable, it's 100% C# managed code on your end - what more can you ask for? :-)
Read all about it here:
Managing Directory Security Principals in the .NET Framework 3.5
MSDN docs on System.DirectoryServices.AccountManagement