Active Directory 开发
[http://www.cnblogs.com/springyangwc/archive/2012/02/07/2340987.html]
概要
活动目录（Active Directory）是面向Windows Standard Server、Windows Enterprise Server以及 Windows Datacenter Server的目录服务。（Active Directory不能运行在Windows Web Server上，但是可以通过它对运行Windows Web Server的计算机进行管理。）Active Directory存储了有关网络对象的信息，并且让管理员和用户能够轻松地查找和使用这些信息。Active Directory使用了一种结构化的数据存储方式，并以此作为基础对目录信息进行合乎逻辑的分层组织。
Microsoft Active Directory 服务是Windows 平台的核心组件，它为用户管理网络环境各个组成要素的标识和关系提供了一种有力的手段。
功能
活动目录(Active Directory)主要提供以下功能：
①基础网络服务：包括DNS、WINS、DHCP、证书服务等。
②服务器及客户端计算机管理：管理服务器及客户端计算机账户，所有服务器及客户端计算机加入域管理并实施组策略。
③用户服务：管理用户域账户、用户信息、企业通讯录（与电子邮件系统集成）、用户组管理、用户身份认证、用户授权管理等，按省实施组管理策略。
④资源管理：管理打印机、文件共享服务等网络资源。
⑤桌面配置：系统管理员可以集中的配置各种桌面配置策略，如：界面功能的限制、应用程序执行特征限制、网络连接限制、安全配置限制等。
⑥应用系统支撑：支持财务、人事、电子邮件、企业信息门户、办公自动化、补丁管理、防病毒系统等各种应用系统。
LDAP
LDAP是轻量目录访问协议，英文全称是Lightweight Directory Access Protocol。
LDAP是基于X.500标准的。
LDAP 仅通过使用原始 X.500目录存取协议 (DAP) 的功能子集而减少了所需的系统资源消耗。
与X.500不同，LDAP支持TCP/IP，这对访问Internet是必须的。
LDAP和关系数据库是两种不同层次的概念，后者是存贮方式（同一层次如网格数据库，对象数据库），前者是存贮模式和访问协议。
LDAP是一个比关系数据库抽象层次更高的存贮概念，与关系数据库的查询语言SQL属同一级别。
开发功能
先看看System.DirectoryServices的代码
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
namespace System.DirectoryServices{ [DSDescription("DirectoryEntryDesc")] [TypeConverter(typeof (DirectoryEntryConverter))] [SecurityPermission(SecurityAction.Assert, Flags = SecurityPermissionFlag.UnmanagedCode)] [EnvironmentPermission(SecurityAction.Assert, Unrestricted = true)] [DirectoryServicesPermission(SecurityAction.LinkDemand, Unrestricted = true)] public class DirectoryEntry : Component { [DirectoryServicesPermission(SecurityAction.Demand, Unrestricted = true)] public DirectoryEntry(); [DirectoryServicesPermission(SecurityAction.Demand, Unrestricted = true)] public DirectoryEntry(string path); [DirectoryServicesPermission(SecurityAction.Demand, Unrestricted = true)] public DirectoryEntry(string path, string username, string password); [DirectoryServicesPermission(SecurityAction.Demand, Unrestricted = true)] public DirectoryEntry(string path, string username, string password, AuthenticationTypes authenticationType); [DirectoryServicesPermission(SecurityAction.Demand, Unrestricted = true)] public DirectoryEntry(object adsObject); [DefaultValue(AuthenticationTypes.Secure)] [DSDescription("DSAuthenticationType")] public AuthenticationTypes AuthenticationType { get; set; } [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] [DSDescription("DSChildren")] [Browsable(false)] public DirectoryEntries Children { get; } [DSDescription("DSGuid")] [Browsable(false)] [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] public Guid Guid { get; } [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] [Browsable(false)] [DSDescription("DSObjectSecurity")] public ActiveDirectorySecurity ObjectSecurity { get; set; } [DSDescription("DSName")] [Browsable(false)] [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] public string Name { get; } [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] [DSDescription("DSNativeGuid")] [Browsable(false)] public string NativeGuid { get; } [DSDescription("DSNativeObject")] [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] [Browsable(false)] public object NativeObject { get; } [DSDescription("DSParent")] [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] [Browsable(false)] public DirectoryEntry Parent { get; } [DefaultValue(null)] [Browsable(false)] [DSDescription("DSPassword")] public string Password { set; } [SettingsBindable(true)] [DefaultValue("")] [TypeConverter("System.Diagnostics.Design.StringValueConverter, System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")] [DSDescription("DSPath")] public string Path { get; set; } [DSDescription("DSProperties")] [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] [Browsable(false)] public PropertyCollection Properties { get; } [DSDescription("DSSchemaClassName")] [Browsable(false)] [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] public string SchemaClassName { get; } [Browsable(false)] [DSDescription("DSSchemaEntry")] [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] public DirectoryEntry SchemaEntry { get; } [DefaultValue(true)] [DSDescription("DSUsePropertyCache")] public bool UsePropertyCache { get; set; } [DSDescription("DSUsername")] [DefaultValue(null)] [Browsable(false)] [TypeConverter("System.Diagnostics.Design.StringValueConverter, System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")] public string Username { get; set; } [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] [ComVisible(false)] [DSDescription("DSOptions")] [Browsable(false)] public DirectoryEntryConfiguration Options { get; } public void Close(); public void CommitChanges(); public DirectoryEntry CopyTo(DirectoryEntry newParent); public DirectoryEntry CopyTo(DirectoryEntry newParent, string newName); public void DeleteTree(); protected override void Dispose(bool disposing); public static bool Exists(string path); public object Invoke(string methodName, params object[] args); [ComVisible(false)] public object InvokeGet(string propertyName); [ComVisible(false)] public void InvokeSet(string propertyName, params object[] args); public void MoveTo(DirectoryEntry newParent); public void MoveTo(DirectoryEntry newParent, string newName); public void RefreshCache(); public void RefreshCache(string[] propertyNames); public void Rename(string newName); }} |
在Active Directory中搜索
1.SearchRoot
指定搜索从哪里开始,如当前节点等
|
1
2
|
DirectorySearcher search = new DirectorySearcher();search.SearchRoot = de; |
2.过滤器
过滤条件是用双引号引起来的括号中的内容如"(&(objectClass=user)(|(description=Auth*)(name=m*)))"
|
1
|
searcher.Filter="(&(objectClass=user)(|(description=Auth*)(name=m*)))" |
3.搜索范围
|
1
|
search.SearchScope = SearchScope.Subtree; |
取值如下:Subtree,Base(只搜索对象中的属性,至多可以得到一个对象),OneLevel(在基对象的子集中搜索,基对象不搜索)
4.加载的属性PropertiesToLoad
对象的很多属性都不太重要,此处定义了加载到缓存中的对象属性,若没有指定,默认是对象的Path和Name属性
|
1
2
3
4
|
search.PropertiesToLoad.Add("name");search.PropertiesToLoad.Add("description");search.PropertiesToLoad.Add("giveName");search.PropertiesToLoad.Add("wWWWHomePage"); |
5.对结果进行排序,Sort函数有两个参数,第一个是要排序的字段,第二个为排序方式SortOption有两个值,Ascending和Descending
|
1
|
search.Sort = new SortOption("givenName",SortDirection.Ascending); |
6.开始搜索,FindAll()查找返回一个SearchResultCollection,FindOne()返回一个简单的SearchResult对象
|
1
|
SearchResultCollection results = searcher.FindAll(); |
根据用户帐号取得AD USER Information
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
/// <summary> /// 根据用户账号取得AD User对象 /// </summary> /// <param name="account"></param> /// <returns></returns> public DirectoryEntry GetUserByAccount(string account) { DirectoryEntry user = null; using (DirectoryEntry entry = new DirectoryEntry(this.LDAPAddress, this.AdminAccount, this.AdminPassword, AuthenticationTypes.Secure)) { using (DirectorySearcher searcher = new DirectorySearcher(entry)) { searcher.Filter = "(&(objectClass=user)(sAMAccountName=" + account + "))"; searcher.SearchScope = SearchScope.Subtree; SearchResult searchResult = searcher.FindOne(); if (searchResult != null) { user = searchResult.GetDirectoryEntry(); } } entry.Close(); } return user; } |
LDAPAddress的值
|
1
|
|
判断用户名字是否存在
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
//判断用户名字是否存在 [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true, PreserveSig = true)] private static extern bool LookupAccountName( string lpSystemName, string lpAccountName, System.IntPtr psid, ref int cbsid, StringBuilder domainName, ref int cbdomainLength, ref int use); public bool LookUpAccount(string accountName) { //pointer an size for the SID IntPtr sid = IntPtr.Zero; int sidSize = 0; //StringBuilder and size for the domain name StringBuilder domainName = new StringBuilder(); int nameSize = 0; //account-type variable for lookup int accountType = 0; //get required buffer size LookupAccountName(String.Empty, accountName, sid, ref sidSize, domainName, ref nameSize, ref accountType); //allocate buffers domainName = new StringBuilder(nameSize); sid = Marshal.AllocHGlobal(sidSize); //lookup the SID for the account bool result = LookupAccountName(String.Empty, accountName, sid, ref sidSize, domainName, ref nameSize, ref accountType); if (result) { if (accountName.ToLower().IndexOf(domainName.ToString().ToLower()) < 0) { accountName = domainName + "\\" + accountName; } //throw.Exception; .Show("The account is : " + accountName); } else { //MessageBox.Show("Can't find the account."); } Marshal.FreeHGlobal(sid); return result; } } |
用户账号是否已处于活动状态（非禁用）
/// <summary>
/// 用户账号是否已处于活动状态（非禁用）
/// </summary>
/// <param name="user"></param>
/// <returns></returns>
private bool IsUserActive(DirectoryEntry user)
{
int val = (int)user.Properties["userAccountControl"].Value;
int flag = (int)(0x0002);
int flagExists = val & flag;
if (flagExists > 0)
return false;
else
return true;
}
用户登陆的实现
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
/// <summary> /// 用户登录验证 /// </summary> /// <param name="account">AD账号</param> /// <param name="password">密码</param> /// <returns> /// <para>True:验证成功</para> /// <para>False:验证失败，如果this.Error不为空，则为异常信息</para> /// </returns> public ADLoginResult Login(string account, string password) { ADLoginResult result = ADLoginResult.UnSuccess; /* Check Accout Empty */ if (string.IsNullOrEmpty(account)) { result = ADLoginResult.UnSuccess; return result; } DirectoryEntry entry = null; DirectoryEntry user = null; try { /* Check Account Exists */ entry = this.GetUserByAccount(account); if (entry != null) { using (entry) { /* Check Account Active */ if (this.IsUserActive(entry)) { /* Check Password */ using (user = new DirectoryEntry(this.LDAPAddress, account, password, AuthenticationTypes.Secure)) { object obj = user.NativeObject; user.Close(); } user = null; result = ADLoginResult.Success; } else { result = ADLoginResult.Disabled; } entry.Close(); } } else { result = ADLoginResult.UnSuccess; } } catch (Exception ex) { this.Error = ex; } finally { if (user != null) { user.Close(); user.Dispose(); } if (entry != null) { entry.Close(); entry.Dispose(); } } return result; } |
修改用户密码
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
/// <summary> /// 修改用户密码 /// </summary> /// <param name="account">AD账号</param> /// <param name="oldPassword">旧密码</param> /// <param name="newPassword">新密码</param> /// <returns> /// <para>ChangePwdResult.Success:：修改成功</para> /// <para>其它：修改失败，如果this.Error不为空，则为异常信息</para> /// </returns> public ChangePwdResult ChangePassword(string account, string oldPassword, string newPassword) { ChangePwdResult result = ChangePwdResult.ChangePwdUnSuccess; /* Check Accout Empty */ if (string.IsNullOrEmpty(account)) { return ChangePwdResult.UserNotExists; } DirectoryEntry user = null; /* Check Login */ ADLoginResult loginSuccess = this.Login(account, oldPassword); try { switch (loginSuccess) { case ADLoginResult.Success: #region [ Success ] user = this.GetUserByAccount(account); if (user != null) { using (user) { bool bImpSuccess = false; if (this.IsUseImpersonate) { bImpSuccess = this._impersonation.BeginImpersonate(); this.ImpsersonateSuccess = bImpSuccess; if (!bImpSuccess) { /* * 打开模拟情况下模拟失败，先将结果默认为AdminLoginUnSuccess； * 如果密码修改成功，则会更新结果为Success；如果异常， */ result = ChangePwdResult.AdminLoginUnSuccess; } } int userAccountControl = Convert.ToInt32(user.Properties["userAccountControl"][0]); /* Change Password */ user.Invoke("SetPassword", new object[] { newPassword }); user.CommitChanges(); if (this.IsUseImpersonate && bImpSuccess) { this._impersonation.StopImpersonate(); } user.Close(); result = ChangePwdResult.Success; } user = null; } else { result = ChangePwdResult.UserNotExists; } #endregion break; case ADLoginResult.UnSuccess: result = ChangePwdResult.WrongOldPwd; break; case ADLoginResult.Disabled: result = ChangePwdResult.Disabled; break; default: result = ChangePwdResult.ChangePwdUnSuccess; break; } } catch (Exception ex) { /* 模拟失败情况下，返回模拟失败 */ if (result != ChangePwdResult.AdminLoginUnSuccess) { result = ChangePwdResult.ChangePwdUnSuccess; } this.Error = ex;/* Get Error */ } finally { if (user != null) { user.Close(); user.Dispose(); } } return result; } |
总结
AD开发主要用于SSO(单点登陆的开发),在office communication 开发中会用到.希望能对大家有帮助.
