确定用户的组成员身份

Question

如何确定用户（例如 Access）是否是 Active Directory 安全组的成员？

我宁愿不在我的小 Access DB 中构建一个完整的身份验证系统。

谢谢

Answer 1

找到阿兰this online

Function IsMember(strDomain As String, strGroup _
  As String, strMember As String) As Boolean
  Dim grp As Object
  Dim strPath As String

  strPath = "WinNT://" & strDomain & "/"
  Set grp = GetObject(strPath & strGroup & ",group")
  IsMember = grp.IsMember(strPath & strMember)
End Function

您可以通过USERDOMAIN 和USERNAME 环境变量获取Windows 帐户信息：

Function GetCurrentUser() As String
    GetCurrentUser = Environ("USERNAME")
End Function

Function GetCurrentDomain() As String
    GetCurrentDomain = Environ("USERDOMAIN")
End Function

把它们放在一起：

If IsMember(GetCurrentDomain, "AD Group", GetCurrentUser) Then
   DoStuff()
End If

Answer 2

我迟到了，但您需要的代码如下。它会为您获取用户名和域名。

请注意，我没有使用 objGroup.Ismember - 这实际上是正确的使用方法 - 我正在枚举用户所在的组列表，因为它更容易调试并且没有明显的性能损失。

...我从早期项目中提取了代码，在该项目中我需要检查“读取报告”组、“编辑数据”组和“编辑系统数据”组的成员资格，以便我可以选择启用哪些控件以及以只读方式打开哪些表单。枚举组一次比三个单独的检查要快。

Public Function UserIsInGroup(GroupName As String, _
                              Optional Username As String, _
                              Optional Domain As String) As Boolean
'On Error Resume Next

' Returns TRUE if the user is in the named NT Group.

' If user name is omitted, current logged-in user's login name is assumed.
' If domain is omitted, current logged-in user's domain is assumed.
' User name can be submitted in the form 'myDomain/MyName' 
'                                        (this will run slightly faster)
' Does not raise errors for unknown user.
'
' Sample Usage: UserIsInGroup( "Domain Users")

Dim strUsername As String
Dim objGroup    As Object
Dim objUser     As Object
Dim objNetwork  As Object

UserIsInGroup = False

If Username = "" Then
    Set objNetwork = CreateObject("WScript.Network")
    strUsername = objNetwork.UserDomain & "/" & objNetwork.Username
Else
    strUsername = Username
End If

strUsername = Replace(strUsername, "\", "/")
If InStr(strUsername, "/") Then
    ' No action: Domain has already been supplied in the user name
Else    
    If Domain = "" Then
        Set objNetwork = CreateObject("WScript.Network")
        Domain = objNetwork.UserDomain
    End If        
    strUsername = Domain & "/" & strUsername        
End If

Set objUser = GetObject("WinNT://" & strUsername & ",user")    
If objUser Is Nothing Then    
    ' Insert error-handler here if you want to report an unknown user name
Else
    For Each objGroup In objUser.Groups
        'Debug.Print objGroup.Name
        If GroupName = objGroup.Name Then
            UserIsInGroup = True
            Exit For
        End If
    Next objGroup
End If

Set objNetwork = Nothing
Set objGroup = Nothing
Set objUser = Nothing

End Function

希望这个迟到的提交对其他开发人员有用：当我第一次查找这个时，早在 2003 年，就好像没有人在 Excel 或 MS-Access 中使用过 AD 组。

Answer 3

找到this online

Function IsMember(strDomain As String, strGroup _
  As String, strMember As String) As Boolean
  Dim grp As Object
  Dim strPath As String

  strPath = "WinNT://" & strDomain & "/"
  Set grp = GetObject(strPath & strGroup & ",group")
  IsMember = grp.IsMember(strPath & strMember)
End Function

现在，我只需要当前用户的帐户名。太糟糕了Application.CurrentUser 没有给我他们的域帐户名称。