Active Directory 子组搜索答案

【问题标题】：Active Directory Subgroups searchActive Directory 子组搜索
【发布时间】：2011-09-12 15:30:13
【问题描述】：

我需要一个根 AD 组，并且需要枚举其所有子组。我有一个代码，它连接到 AD 服务器并尝试检索子组列表。

代码如下：

        private IEnumerable<SearchResult> GetSubGroups(string groupId)
        {
            using (var searcher = new DirectorySearcher(new DirectoryEntry(adServerName, adLogin, adPassword)))
            {

                searcher.Filter = string.Format("(&(objectClass=group)({0}))", groupId);
                //Get the Root Group
                var result = searcher.FindOne();
                object resultMembers = result.GetDirectoryEntry().Invoke("Members", null);

                foreach(var member in ((IEnumerable) resultMembers))
                {
                    var memberEntry = new DirectoryEntry(member);

                    var subgroupsSearcher = new DirectorySearcher(memberEntry);
                    subgroupsSearcher.Filter = "(objectClass=group)";
                    subgroupsSearcher.PropertiesToLoad.Add("samaccountname");
                    subgroupsSearcher.PropertiesToLoad.Add("name");

                    var foundSubGroupResult = subgroupsSearcher.FindOne();

                    ...
                }

                return new List<SearchResult> {result};
            }
    }

当枚举 Invoke("Members", null) 结果时，我为每个结果创建另一个 DirectoryEntry。问题是，当调用 subgroupSearcher.FindOne() 时，它会以 DirectoryServicesCOMException 结束。

Here's the exception stack trace:
at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_AdsObject()
at System.DirectoryServices.DirectorySearcher.FindAll(Boolean findMoreThanOne)
at System.DirectoryServices.DirectorySearcher.FindOne()
...other methods...

异常的消息属性说："An operations error occured" 我已经记录了错误代码，它是-2147016672

在从子组对象创建 DirectoryEntry 时，我还尝试隐式初始化 UserName 属性：

foreach(var member in ((IEnumerable) resultMembers))
                    {
                        var memberEntry = new DirectoryEntry(member);
                        memberEntry.Username = adLogin;
                        var subgroupsSearcher = new DirectorySearcher(memberEntry)

                        ...
                    }

但它给出了相同的结果。

我做错了什么？任何帮助都是可观的。

【问题讨论】：

也许这是一个错字，但你调用了一个名为 FindAOne 的函数，尽管有 FindOne。
这里是印刷错误，已修复。在代码中我调用 FindOne()

标签： active-directory active-directory-group

【解决方案1】：

不确定您为什么要调用 Invoke("members")。您只想让 DirectorySearcher 将组的成员属性返回给您。你需要处理两件事：

属性值范围 - http://www.netid.washington.edu/documentation/enumeratingLargeGroups.aspx
嵌套循环 - 您的代码将需要跟踪您已经展开的组，这样您就不会一遍又一遍地这样做

【讨论】：

【解决方案2】：

这是一段代码。它允许使用递归过滤器查看Search Filter Syntax 来检索类'group'（你称之为子组的东西）组的所有成员

static void Main(string[] args)
{
  /* Connection to Active Directory
   */
  string sFromWhere = "LDAP://WM2008R2ENT:389/dc=dom,dc=fr";
  DirectoryEntry deBase = new DirectoryEntry(sFromWhere, "dom\\jpb", "test.2011");

  /* To find all the groups member of groups "Grp1"  :
   * Set the base to the groups container DN; for example root DN (dc=societe,dc=fr) 
   * Set the scope to subtree
   * Use the following filter :
   * (member:1.2.840.113556.1.4.1941:=CN=Grp1,OU=MonOu,DC=X)
   * coupled with a AND Bit filter on userAccountControl
   */
  DirectorySearcher dsLookFor = new DirectorySearcher(deBase);
  dsLookFor.Filter = "(&(memberof:1.2.840.113556.1.4.1941:=CN=MonGrpSec,OU=MonOu,DC=dom,DC=fr)(objectClass=group))";
  dsLookFor.SearchScope = SearchScope.Subtree;
  dsLookFor.PropertiesToLoad.Add("cn");

  SearchResultCollection srcGroups = dsLookFor.FindAll();

  /* Just to write some result
   */
  foreach (SearchResult srcGroup in srcGroups)
  {
    Console.WriteLine("{0}", srcGroup.Path);
  }

  Console.ReadLine();
}

【讨论】：