1 using System;
2 using System.DirectoryServices;
3
4 namespace SystemFrameworks.Helper
5 {
6 ///
7 ///活动目录辅助类。封装一系列活动目录操作相关的方法。
8 ///
9 public sealed class ADHelper
10 {
11 ///
12 ///域名
13 ///
14 private static string DomainName = "MyDomain";
15 ///
16 /// LDAP 地址
17 ///
18 private static string LDAPDomain = "DC=MyDomain,DC=local";
19 ///
20 /// LDAP绑定路径
21 ///
22 private static string ADPath = "LDAP://brooks.mydomain.local";
23 ///
24 ///登录帐号
25 ///
26 private static string ADUser = "Administrator";
27 ///
28 ///登录密码
29 ///
30 private static string ADPassword = "password";
31 ///
32 ///扮演类实例
33 ///
34 private static IdentityImpersonation impersonate = new IdentityImpersonation(ADUser, ADPassword, DomainName);
35
36 ///
37 ///用户登录验证结果
38 ///
39 public enum LoginResult
40 {
41 ///
42 ///正常登录
43 ///
44 LOGIN_USER_OK = 0,
45 ///
46 ///用户不存在
47 ///
48 LOGIN_USER_DOESNT_EXIST,
49 ///
50 ///用户帐号被禁用
51 ///
52 LOGIN_USER_ACCOUNT_INACTIVE,
53 ///
54 ///用户密码不正确
55 ///
56 LOGIN_USER_PASSWORD_INCORRECT
57 }
58
59 ///
60 ///用户属性定义标志
61 ///
62 public enum ADS_USER_FLAG_ENUM
63 {
64 ///
65 ///登录脚本标志。如果通过 ADSI LDAP 进行读或写操作时，该标志失效。如果通过 ADSI WINNT，该标志为只读。
66 ///
67 ADS_UF_SCRIPT = 0X0001,
68 ///
69 ///用户帐号禁用标志
70 ///
71 ADS_UF_ACCOUNTDISABLE = 0X0002,
72 ///
73 ///主文件夹标志
74 ///
75 ADS_UF_HOMEDIR_REQUIRED = 0X0008,
76 ///
77 ///过期标志
78 ///
79 ADS_UF_LOCKOUT = 0X0010,
80 ///
81 ///用户密码不是必须的
82 ///
83 ADS_UF_PASSWD_NOTREQD = 0X0020,
84 ///
85 ///密码不能更改标志
86 ///
87 ADS_UF_PASSWD_CANT_CHANGE = 0X0040,
88 ///
89 ///使用可逆的加密保存密码
90 ///
91 ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 0X0080,
92 ///
93 ///本地帐号标志
94 ///
95 ADS_UF_TEMP_DUPLICATE_ACCOUNT = 0X0100,
96 ///
97 ///普通用户的默认帐号类型
98 ///
99 ADS_UF_NORMAL_ACCOUNT = 0X0200,
100 ///
101 ///跨域的信任帐号标志
102 ///
103 ADS_UF_INTERDOMAIN_TRUST_ACCOUNT = 0X0800,
104 ///
105 ///工作站信任帐号标志
106 ///
107 ADS_UF_WORKSTATION_TRUST_ACCOUNT = 0x1000,
108 ///
109 ///服务器信任帐号标志
110 ///
111 ADS_UF_SERVER_TRUST_ACCOUNT = 0X2000,
112 ///
113 ///密码永不过期标志
114 ///
115 ADS_UF_DONT_EXPIRE_PASSWD = 0X10000,
116 ///
117 /// MNS 帐号标志
118 ///
119 ADS_UF_MNS_LOGON_ACCOUNT = 0X20000,
120 ///
121 ///交互式登录必须使用智能卡
122 ///
123 ADS_UF_SMARTCARD_REQUIRED = 0X40000,
124 ///
125 ///当设置该标志时，服务帐号（用户或计算机帐号）将通过 Kerberos 委托信任
126 ///
127 ADS_UF_TRUSTED_FOR_DELEGATION = 0X80000,
128 ///
129 ///当设置该标志时，即使服务帐号是通过 Kerberos 委托信任的，敏感帐号不能被委托
130 ///
131 ADS_UF_NOT_DELEGATED = 0X100000,
132 ///
133 ///此帐号需要 DES 加密类型
134 ///
135 ADS_UF_USE_DES_KEY_ONLY = 0X200000,
136 ///
137 ///不要进行 Kerberos 预身份验证
138 ///
139 ADS_UF_DONT_REQUIRE_PREAUTH = 0X4000000,
140 ///
141 ///用户密码过期标志
142 ///
143 ADS_UF_PASSWORD_EXPIRED = 0X800000,
144 ///
145 ///用户帐号可委托标志
146 ///
147 ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 0X1000000
148 }
149
150 public ADHelper()
151 {
152 //
153 }
154
155 #region GetDirectoryObject
156
157 ///
158 ///获得DirectoryEntry对象实例,以管理员登陆AD
159 ///
160 ///
161 private static DirectoryEntry GetDirectoryObject()
162 {
163 DirectoryEntry entry = new DirectoryEntry(ADPath, ADUser, ADPassword, AuthenticationTypes.Secure);
164 return entry;
165 }
166
167 ///
168 ///根据指定用户名和密码获得相应DirectoryEntry实体
169 ///
170 ///
171 ///
172 ///
173 private static DirectoryEntry GetDirectoryObject(string userName, string password)
174 {
175 DirectoryEntry entry = new DirectoryEntry(ADPath, userName, password, AuthenticationTypes.None);
176 return entry;
177 }
178
179 ///
180 /// i.e. /CN=Users,DC=creditsights, DC=cyberelves, DC=Com
181 ///
182 ///
183 ///
184 private static DirectoryEntry GetDirectoryObject(string domainReference)
185 {
186 DirectoryEntry entry = new DirectoryEntry(ADPath + domainReference, ADUser, ADPassword, AuthenticationTypes.Secure);
187 return entry;
188 }
189
190 ///
191 ///获得以UserName,Password创建的DirectoryEntry
192 ///
193 ///
194 ///
195 ///
196 ///
197 private static DirectoryEntry GetDirectoryObject(string domainReference, string userName, string password)
198 {
199 DirectoryEntry entry = new DirectoryEntry(ADPath + domainReference, userName, password, AuthenticationTypes.Secure);
200 return entry;
201 }
202
203 #endregion
204
205 #region GetDirectoryEntry
206
207 ///
208 ///根据用户公共名称取得用户的 对象
209 ///
210 ///
211 用户公共名称
212 ///如果找到该用户，则返回用户的 对象；否则返回 null
213 public static DirectoryEntry GetDirectoryEntry(string commonName)
214 {
215 DirectoryEntry de = GetDirectoryObject();
216 DirectorySearcher deSearch = new DirectorySearcher(de);
217 deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(cn=" + commonName + "))";
218 deSearch.SearchScope = SearchScope.Subtree;
219
220 try
221 {
222 SearchResult result = deSearch.FindOne();
223 de = new DirectoryEntry(result.Path);
224 return de;
225 }
226 catch
227 {
228 return null;
229 }
230 }
231
232 ///
233 ///根据用户公共名称和密码取得用户的 对象。
234 ///
235 ///
236 用户公共名称
237 ///
238 用户密码
239 ///如果找到该用户，则返回用户的 对象；否则返回 null
240 public static DirectoryEntry GetDirectoryEntry(string commonName, string password)
241 {
242 DirectoryEntry de = GetDirectoryObject(commonName, password);
243 DirectorySearcher deSearch = new DirectorySearcher(de);
244 deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(cn=" + commonName + "))";
245 deSearch.SearchScope = SearchScope.Subtree;
246
247 try
248 {
249 SearchResult result = deSearch.FindOne();
250 de = new DirectoryEntry(result.Path);
251 return de;
252 }
253 catch
254 {
255 return null;
256 }
257 }
258
259 ///
260 ///根据用户帐号称取得用户的 对象
261 ///
262 ///
263 用户帐号名
264 ///如果找到该用户，则返回用户的 对象；否则返回 null
265 public static DirectoryEntry GetDirectoryEntryByAccount(string sAMAccountName)
266 {
267 DirectoryEntry de = GetDirectoryObject();
268 DirectorySearcher deSearch = new DirectorySearcher(de);
269 deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(sAMAccountName=" + sAMAccountName + "))";
270 deSearch.SearchScope = SearchScope.Subtree;
271
272 try
273 {
274 SearchResult result = deSearch.FindOne();
275 de = new DirectoryEntry(result.Path);
276 return de;
277 }
278 catch
279 {
280 return null;
281 }
282 }
283
284 ///
285 ///根据用户帐号和密码取得用户的 对象
286 ///
287 ///
288 用户帐号名
289 ///
290 用户密码
291 ///如果找到该用户，则返回用户的 对象；否则返回 null
292 public static DirectoryEntry GetDirectoryEntryByAccount(string sAMAccountName, string password)
293 {
294 DirectoryEntry de = GetDirectoryEntryByAccount(sAMAccountName);
295 if (de != null)
296 {
297 string commonName = de.Properties["cn"][0].ToString();
298
299 if (GetDirectoryEntry(commonName, password) != null)
300 return GetDirectoryEntry(commonName, password);
301 else
302 return null;
303 }
304 else
305 {
306 return null;
307 }
308 }
309
310 ///
311 ///根据组名取得用户组的 对象
312 ///
313 ///
314 组名
315 ///
316 public static DirectoryEntry GetDirectoryEntryOfGroup(string groupName)
317 {
318 DirectoryEntry de = GetDirectoryObject();
319 DirectorySearcher deSearch = new DirectorySearcher(de);
320 deSearch.Filter = "(&(objectClass=group)(cn=" + groupName + "))";
321 deSearch.SearchScope = SearchScope.Subtree;
322
323 try
324 {
325 SearchResult result = deSearch.FindOne();
326 de = new DirectoryEntry(result.Path);
327 return de;
328 }
329 catch
330 {
331 return null;
332 }
333 }
334
335 #endregion
336
337 #region GetProperty
338
339 ///
340 ///获得指定 指定属性名对应的值
341 ///
342 ///
343 ///
344 属性名称
345 ///属性值
346 public static string GetProperty(DirectoryEntry de, string propertyName)
347 {
348 if(de.Properties.Contains(propertyName))
349 {
350 return de.Properties[propertyName][0].ToString() ;
351 }
352 else
353 {
354 return string.Empty;
355 }
356 }
357
358 ///
359 ///获得指定搜索结果 中指定属性名对应的值
360 ///
361 ///
362 ///
363 属性名称
364 ///属性值
365 public static string GetProperty(SearchResult searchResult, string propertyName)
366 {
367 if(searchResult.Properties.Contains(propertyName))
368 {
369 return searchResult.Properties[propertyName][0].ToString() ;
370 }
371 else
372 {
373 return string.Empty;
374 }
375 }
376
377 #endregion
378
379 ///
380 ///设置指定 的属性值
381 ///
382 ///
383 ///
384 属性名称
385 ///
386 属性值
387 public static void SetProperty(DirectoryEntry de, string propertyName, string propertyValue)
388 {
389 if(propertyValue != string.Empty || propertyValue != "" || propertyValue != null)
390 {
391 if(de.Properties.Contains(propertyName))
392 {
393 de.Properties[propertyName][0] = propertyValue;
394 }
395 else
396 {
397 de.Properties[propertyName].Add(propertyValue);
398 }
399 }
400 }
401
402 ///
403 ///创建新的用户
404 ///
405 ///
406 DN 位置。例如：OU=共享平台 或 CN=Users
407 ///
408 公共名称
409 ///
410 帐号
411 ///
412 密码
413 ///
414 public static DirectoryEntry CreateNewUser(string ldapDN, string commonName, string sAMAccountName, string password)
415 {
416 DirectoryEntry entry = GetDirectoryObject();
417 DirectoryEntry subEntry = entry.Children.Find(ldapDN);
418 DirectoryEntry deUser = subEntry.Children.Add("CN=" + commonName, "user");
419 deUser.Properties["sAMAccountName"].Value = sAMAccountName;
420 deUser.CommitChanges();
421 ADHelper.EnableUser(commonName);
422 ADHelper.SetPassword(commonName, password);
423 deUser.Close();
424 return deUser;
425 }
426
427 ///
428 ///创建新的用户。默认创建在 Users 单元下。
429 ///
430 ///
431 公共名称
432 ///
433 帐号
434 ///
435 密码
436 ///
437 public static DirectoryEntry CreateNewUser(string commonName, string sAMAccountName, string password)
438 {
439 return CreateNewUser("CN=Users", commonName, sAMAccountName, password);
440 }
441
442 ///
443 ///判断指定公共名称的用户是否存在
444 ///
445 ///
446 用户公共名称
447 ///如果存在，返回 true；否则返回 false
448 public static bool IsUserExists(string commonName)
449 {
450 DirectoryEntry de = GetDirectoryObject();
451 DirectorySearcher deSearch = new DirectorySearcher(de);
452 deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(cn=" + commonName + "))"; // LDAP 查询串
453 SearchResultCollection results = deSearch.FindAll();
454
455 if (results.Count == 0)
456 return false;
457 else
458 return true;
459 }
460
461 ///
462 ///判断用户帐号是否激活
463 ///
464 ///
465 用户帐号属性控制器
466 ///如果用户帐号已经激活，返回 true；否则返回 false
467 public static bool IsAccountActive(int userAccountControl)
468 {
469 int userAccountControl_Disabled = Convert.ToInt32(ADS_USER_FLAG_ENUM.ADS_UF_ACCOUNTDISABLE);
470 int flagExists = userAccountControl & userAccountControl_Disabled;
471
472 if (flagExists > 0)
473 return false;
474 else
475 return true;
476 }
477
478 ///
479 ///判断用户与密码是否足够以满足身份验证进而登录
480 ///
481 ///
482 用户公共名称
483 ///
484 密码
485 ///如能可正常登录，则返回 true；否则返回 false
486 public static LoginResult Login(string commonName, string password)
487 {
488 DirectoryEntry de = GetDirectoryEntry(commonName);
489
490 if (de != null)
491 {
492 // 必须在判断用户密码正确前，对帐号激活属性进行判断；否则将出现异常。
493 int userAccountControl = Convert.ToInt32(de.Properties["userAccountControl"][0]);
494 de.Close();
495
496 if (!IsAccountActive(userAccountControl))
497 return LoginResult.LOGIN_USER_ACCOUNT_INACTIVE;
498
499 if (GetDirectoryEntry(commonName, password) != null)
500 return LoginResult.LOGIN_USER_OK;
501 else
502 return LoginResult.LOGIN_USER_PASSWORD_INCORRECT;
503 }
504 else
505 {
506 return LoginResult.LOGIN_USER_DOESNT_EXIST;
507 }
508 }
509
510 ///
511 ///判断用户帐号与密码是否足够以满足身份验证进而登录
512 ///
513 ///
514 用户帐号
515 ///
516 密码
517 ///如能可正常登录，则返回 true；否则返回 false
518 public static LoginResult LoginByAccount(string sAMAccountName, string password)
519 {
520 DirectoryEntry de = GetDirectoryEntryByAccount(sAMAccountName);
521
522 if (de != null)
523 {
524 // 必须在判断用户密码正确前，对帐号激活属性进行判断；否则将出现异常。
525 int userAccountControl = Convert.ToInt32(de.Properties["userAccountControl"][0]);
526 de.Close();
527
528 if (!IsAccountActive(userAccountControl))
529 return LoginResult.LOGIN_USER_ACCOUNT_INACTIVE;
530
531 if (GetDirectoryEntryByAccount(sAMAccountName, password) != null)
532 return LoginResult.LOGIN_USER_OK;
533 else
534 return LoginResult.LOGIN_USER_PASSWORD_INCORRECT;
535 }
536 else
537 {
538 return LoginResult.LOGIN_USER_DOESNT_EXIST;
539 }
540 }
541
542 ///
543 ///设置用户密码，管理员可以通过它来修改指定用户的密码。
544 ///
545 ///
546 用户公共名称
547 ///
548 用户新密码
549 public static void SetPassword(string commonName, string newPassword)
550 {
551 DirectoryEntry de = GetDirectoryEntry(commonName);
552
553 // 模拟超级管理员，以达到有权限修改用户密码
554 impersonate.BeginImpersonate();
555 de.Invoke("SetPassword", new object[]{newPassword});
556 impersonate.StopImpersonate();
557
558 de.Close();
559 }
560
561 ///
562 ///设置帐号密码，管理员可以通过它来修改指定帐号的密码。
563 ///
564 ///
565 用户帐号
566 ///
567 用户新密码
568 public static void SetPasswordByAccount(string sAMAccountName, string newPassword)
569 {
570 DirectoryEntry de = GetDirectoryEntryByAccount(sAMAccountName);
571
572 // 模拟超级管理员，以达到有权限修改用户密码
573 IdentityImpersonation impersonate = new IdentityImpersonation(ADUser, ADPassword, DomainName);
574 impersonate.BeginImpersonate();
575 de.Invoke("SetPassword", new object[]{newPassword});
576 impersonate.StopImpersonate();
577
578 de.Close();
579 }
580
581 ///
582 ///修改用户密码
583 ///
584 ///
585 用户公共名称
586 ///
587 旧密码
588 ///
589 新密码
590 public static void ChangeUserPassword (string commonName, string oldPassword, string newPassword)
591 {
592 // to-do: 需要解决密码策略问题
593 DirectoryEntry oUser = GetDirectoryEntry(commonName);
594 oUser.Invoke("ChangePassword", new Object[]{oldPassword, newPassword});
595 oUser.Close();
596 }
597
598 ///
599 ///启用指定公共名称的用户
600 ///
601 ///
602 用户公共名称
603 public static void EnableUser(string commonName)
604 {
605 EnableUser(GetDirectoryEntry(commonName));
606 }
607
608 ///
609 ///启用指定 的用户
610 ///
611 ///
612 public static void EnableUser(DirectoryEntry de)
613 {
614 impersonate.BeginImpersonate();
615 de.Properties["userAccountControl"][0] = ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_NORMAL_ACCOUNT | ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_DONT_EXPIRE_PASSWD;
616 de.CommitChanges();
617 impersonate.StopImpersonate();
618 de.Close();
619 }
620
621 ///
622 ///禁用指定公共名称的用户
623 ///
624 ///
625 用户公共名称
626 public static void DisableUser(string commonName)
627 {
628 DisableUser(GetDirectoryEntry(commonName));
629 }
630
631 ///
632 ///禁用指定 的用户
633 ///
634 ///
635 public static void DisableUser(DirectoryEntry de)
636 {
637 impersonate.BeginImpersonate();
638 de.Properties["userAccountControl"][0]=ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_NORMAL_ACCOUNT | ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_DONT_EXPIRE_PASSWD | ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_ACCOUNTDISABLE;
639 de.CommitChanges();
640 impersonate.StopImpersonate();
641 de.Close();
642 }
643
644 ///
645 ///将指定的用户添加到指定的组中。默认为 Users 下的组和用户。
646 ///
647 ///
648 用户公共名称
649 ///
650 组名
651 public static void AddUserToGroup(string userCommonName, string groupName)
652 {
653 DirectoryEntry oGroup = GetDirectoryEntryOfGroup(groupName);
654 DirectoryEntry oUser = GetDirectoryEntry(userCommonName);
655
656 impersonate.BeginImpersonate();
657 oGroup.Properties["member"].Add(oUser.Properties["distinguishedName"].Value);
658 oGroup.CommitChanges();
659 impersonate.StopImpersonate();
660
661 oGroup.Close();
662 oUser.Close();
663 }
664
665 ///
666 ///将用户从指定组中移除。默认为 Users 下的组和用户。
667 ///
668 ///
669 用户公共名称
670 ///
671 组名
672 public static void RemoveUserFromGroup(string userCommonName, string groupName)
673 {
674 DirectoryEntry oGroup = GetDirectoryEntryOfGroup(groupName);
675 DirectoryEntry oUser = GetDirectoryEntry(userCommonName);
676
677 impersonate.BeginImpersonate();
678 oGroup.Properties["member"].Remove(oUser.Properties["distinguishedName"].Value);
679 oGroup.CommitChanges();
680 impersonate.StopImpersonate();
681
682 oGroup.Close();
683 oUser.Close();
684 }
685
686 }
687
688 ///
689 ///用户模拟角色类。实现在程序段内进行用户角色模拟。
690 ///
691 public class IdentityImpersonation
692 {
693 [DllImport("advapi32.dll", SetLastError=true)]
694 public static extern bool LogonUser(String lpszUsername, String lpszDomain, String lpszPassword, int dwLogonType, int dwLogonProvider, ref IntPtr phToken);
695
696 [DllImport("advapi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
697 public extern static bool DuplicateToken(IntPtr ExistingTokenHandle, int SECURITY_IMPERSONATION_LEVEL, ref IntPtr DuplicateTokenHandle);
698
699 [DllImport("kernel32.dll", CharSet=CharSet.Auto)]
700 public extern static bool CloseHandle(IntPtr handle);
701
702 // 要模拟的用户的用户名、密码、域(机器名)
703 private String _sImperUsername;
704 private String _sImperPassword;
705 private String _sImperDomain;
706 // 记录模拟上下文
707 private WindowsImpersonationContext _imperContext;
708 private IntPtr _adminToken;
709 private IntPtr _dupeToken;
710 // 是否已停止模拟
711 private Boolean _bClosed;
712
713 ///
714 ///构造函数
715 ///
716 ///
717 所要模拟的用户的用户名
718 ///
719 所要模拟的用户的密码
720 ///
721 所要模拟的用户所在的域
722 public IdentityImpersonation(String impersonationUsername, String impersonationPassword, String impersonationDomain)
723 {
724 _sImperUsername = impersonationUsername;
725 _sImperPassword = impersonationPassword;
726 _sImperDomain = impersonationDomain;
727
728 _adminToken = IntPtr.Zero;
729 _dupeToken = IntPtr.Zero;
730 _bClosed = true;
731 }
732
733 ///
734 ///析构函数
735 ///
736 ~IdentityImpersonation()
737 {
738 if(!_bClosed)
739 {
740 StopImpersonate();
741 }
742 }
743
744 ///
745 ///开始身份角色模拟。
746 ///
747 ///
748 public Boolean BeginImpersonate()
749 {
750 Boolean bLogined = LogonUser(_sImperUsername, _sImperDomain, _sImperPassword, 2, 0, ref _adminToken);
751
752 if(!bLogined)
753 {
754 return false;
755 }
756
757 Boolean bDuped = DuplicateToken(_adminToken, 2, ref _dupeToken);
758
759 if(!bDuped)
760 {
761 return false;
762 }
763
764 WindowsIdentity fakeId = new WindowsIdentity(_dupeToken);
765 _imperContext = fakeId.Impersonate();
766
767 _bClosed = false;
768
769 return true;
770 }
771
772 ///
773 ///停止身分角色模拟。
774 ///
775 public void StopImpersonate()
776 {
777 _imperContext.Undo();
778 CloseHandle(_dupeToken);
779 CloseHandle(_adminToken);
780 _bClosed = true;
781 }
782 }
783 }
784 =====================================================
785
786 简单的应用
787
788 [WebMethod]
789 public string IsAuthenticated(string UserID,string Password)
790 {
791 string _path = "LDAP://" + adm + "/DC=lamda,DC=com,DC=cn";//"LDAP://172.75.200.1/DC=名字,DC=com,DC=cn";
792 string _filterAttribute=null;
793
794 DirectoryEntry entry = new DirectoryEntry(_path,UserID,Password);
795
796 try
797 {
798 //Bind to the native AdsObject to force authentication.
799 DirectorySearcher search = new DirectorySearcher(entry);
800 search.Filter = "(SAMAccountName=" + UserID + ")";
801 SearchResult result = search.FindOne();
802
803 if(null == result)
804 {
805 _filterAttribute="登录失败: 未知的用户名或错误密码.";
806 }
807 else
808 {
809 _filterAttribute="true";
810 }
811
812 }
813 catch (Exception ex)
814 {
815 // if(ex.Message.StartsWith("该服务器不可操作"))
816 // {
817 // string mail = ADO.GetConnString("mail");
818 // entry.Path = "LDAP://"+mail+"/OU=名字,DC=it2004,DC=gree,DC=com,DC=cn";
819 // try
820 // {
821 // DirectorySearcher search = new DirectorySearcher(entry);
822 // search.Filter = "(SAMAccountName=" + UserID + ")";
823 // SearchResult result = search.FindOne();
824 //
825 // if(null == result)
826 // {
827 // _filterAttribute="登录失败: 未知的用户名或错误密码.";
828 // }
829 // else
830 // {
831 // _filterAttribute="true";
832 // }
833 // return _filterAttribute;
834 //
835 // }
836 // catch (Exception ex1)
837 // {
838 // return ex1.Message;
839 // }
840 //
841 // }
842 // else
843 return ex.Message;
844 }
845 return _filterAttribute;
846 }
847 [WebMethod]
848 public string[] LDAPMessage(string UserID)
849 {
850 string _path = "LDAP://"+adm+"/DC=it2004,DC=名字,DC=com,DC=cn";
851 string[] _filterAttribute=new string[5];
852 string[] msg = {"samaccountname","displayname","department","company"};
853
854 DirectoryEntry entry = new DirectoryEntry(_path,"180037","790813");
855
856
857 try
858 {
859
860
861 Object obj = entry.NativeObject;
862
863 DirectorySearcher search = new DirectorySearcher(entry);
864 search.Filter = "(SAMAccountName=" + UserID + ")";
865 SearchResult result = search.FindOne();
866
867
868 if(null == result)
869 {
870 _filterAttribute[0]="登录失败: 未知的用户名或错误密码.";
871 }
872 else
873 {
874 _filterAttribute[0]="true";
875 for(int propertyCounter = 1; propertyCounter < 5; propertyCounter++)
876 {
877
878 if(propertyCounter==4 && result.Properties[msg[propertyCounter-1]][0]==null)
879 break;
880 _filterAttribute[propertyCounter]=result.Properties[msg[propertyCounter-1]][0].ToString();
881
882 }
883 }
884
885 }
886 catch (Exception ex)
887 {
888 //_filterAttribute[0]=ex.Message;
889 }
890 return _filterAttribute;
891 }
892 [WebMethod]
893 public string[] AllMembers()
894 {
895
896 string[] msg;
897 string _path = "LDAP://名字";
898
899 DirectoryEntry entry = new DirectoryEntry(_path,"180037","790813");
900
901
902 //Bind to the native AdsObject to force authentication.
903 Object obj = entry.NativeObject;
904
905 System.DirectoryServices.DirectorySearcher mySearcher = new System.DirectoryServices.DirectorySearcher(entry);
906 mySearcher.Filter = "(SAMAccountName=180037)";
907 msg=new string[mySearcher.FindAll().Count];
908 int i=0;
909 foreach(System.DirectoryServices.SearchResult result in mySearcher.FindAll())
910 {
911 msg[i++]=result.Path;
912 }
913 return msg;
914 }
915
916 }
