Tobi + C# = T#

Active Directory Tip #9 – How to escape the Path property

by Tobias Hertkorn on May 17th, 2010

Did you get the dreaded 0x80005000 COMException "Unknown error"? Maybe you should check, if your AD entry contains a forward slash '/' in its DN. Because there is a subtile difference between a correctly escaped distinguished name and a correctly escaped ldap path.

Observe:

PLAIN TEXT

PLAIN:

Unescaped: CN=Test\ Me \\ huhu \/ cool / \\/ // \\// \\\/// \\\\////! /////,OU=AdTests,DC=test,DC=domain,DC=local
Escaped DN: CN=Test\\ Me \\\\ huhu \\/ cool / \\\\/ // \\\\// \\\\\\/// \\\\\\\\////! /////,OU=AdTests,DC=test,DC=domain,DC=local
Escaped Path: LDAP://test.domain.local:389/CN=Test\\ Me \\\\ huhu \\\/ cool \/ \\\\\/ \/\/ \\\\\/\/ \\\\\\\/\/\/ \\\\\\\\\/\/\/\/! \/\/\/\/\/,OU=AdTests,DC=test,DC=domain,DC=local

Notice how forward slashes need to be escaped in addition to how distinguished names get escaped. This is a very subtile thing that is often overlooked. So when converting between DNs and Paths you have to use the following methods:

PLAIN TEXT

C#:

private static readonly string LDAP_PREFIX = @"LDAP://test.domain.local:389/";
private static string ConvertDnToPath(string dn)
{
var exploded = dn.ToCharArray();
StringBuilder sb = new StringBuilder();
foreach (var @char in exploded)
{
if (@char == '/')
{
sb.Append('\\');
}
sb.Append(@char);
}
return LDAP_PREFIX + sb.ToString();
}
private static string ConvertPathToDn(string path)
{
path = path.Substring(path.IndexOf('/', "LDAP://".Length));
// remove leading /
while (path.StartsWith("/"))
{
path = path.Substring(1);
}
if (!path.Contains('/'))
{
return path;
}
StringBuilder sb = new StringBuilder(path);
bool slashMode = false;
int backslashCount = 0;
for (int i = path.Length - 1; i>= 0; i--)
{
if (path[i] == '\\' && slashMode)
{
backslashCount++;
}
else if (slashMode)
{
if ((backslashCount % 2) != 0)
{
sb.Remove(i + 1, 1);
}
backslashCount = 0;
slashMode = false;
}
if (path[i] == '/')
{
backslashCount = 0;
slashMode = true;
}
}
return sb.ToString();
}

Tweet this

May 17th, 2010 9:00 pm | Comments (0)

Active Directory Tip #8 – Set Password of user

by Tobias Hertkorn on May 14th, 2010

The password of a person entry is not a regular property with direct access for reading and writing. Instead it can't be read just indirectly written to via the setPassword method.

PLAIN TEXT

C#:

string password = "secret";
directoryEntry.Invoke("setPassword", password);
directoryEntry.RefreshCache();

The caller must have the User-Force-Change-Password Extended Right to set the password with this method.

Tweet this

May 14th, 2010 8:21 pm | Comments (0)

Active Directory Tip #7 – Handling a Bit Property (e.g. userAccountControl – Account is disabled)

by Tobias Hertkorn on May 12th, 2010

Bit properties like User-Account-Control Attribute in the Active Directory are represented by regular integers. Therefore all the usual bit operation may be performed on those fields.

PLAIN TEXT

C#:

public static bool GetBitAttribute(DirectoryEntry directoryEntry, string attributeName, int bitmask)
{
int value = (int)DirectoryEntryHelper.GetAdObjectProperty(directoryEntry, attributeName);
bool result = (bitmask & value) == bitmask;
return result;
}
public static void SetBitAttribute(DirectoryEntry directoryEntry, string attributeName, int bitmask, bool attributeValue)
{
PropertyValueCollection property = directoryEntry.Properties[attributeName];
int value = (int)property.Value;
if (attributeValue)
{
value |= bitmask;
}
else
{
value &= ~bitmask;
}
property.Value = value;
}

With these helper functions deactivating a user would be accomplished by using

PLAIN TEXT

C#:

SetBitAttribute(directoryEntry, "userAccountControl", ADS_UF_ACCOUNTDISABLE, true);

Just for convenience, here is the table form User-Account-Control Attribute converted to C# syntax:

PLAIN TEXT

C#:

/// <summary>
/// The logon script is executed.
/// </summary>
int ADS_UF_SCRIPT = 0x00000001;
/// <summary>
/// The user account is disabled.
/// </summary>
int ADS_UF_ACCOUNTDISABLE = 0x00000002;
/// <summary>
/// The home directory is required.
/// </summary>
int ADS_UF_HOMEDIR_REQUIRED = 0x00000008;
/// <summary>
/// The account is currently locked out.
/// </summary>
int ADS_UF_LOCKOUT = 0x00000010;
/// <summary>
/// No password is required.
/// </summary>
int ADS_UF_PASSWD_NOTREQD = 0x00000020;
/// <summary>
/// The user cannot change the password.
/// </summary>
int ADS_UF_PASSWD_CANT_CHANGE = 0x00000040;
/// <summary>
/// The user can send an encrypted password.
/// </summary>
int ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 0x00000080;
/// <summary>
/// This is an account for users whose primary account is in
/// another domain. This account provides user access to this
/// domain, but not to any domain that trusts this domain.
/// Also known as a local user account.
/// </summary>
int ADS_UF_TEMP_DUPLICATE_ACCOUNT = 0x00000100;
/// <summary>
/// This is a default account type that represents a typical user.
/// </summary>
int ADS_UF_NORMAL_ACCOUNT = 0x00000200;
/// <summary>
/// This is a permit to trust account for a system domain that
/// trusts other domains.
/// </summary>
int ADS_UF_INTERDOMAIN_TRUST_ACCOUNT = 0x00000800;
/// <summary>
/// This is a computer account for a computer that is a member
/// of this domain.
/// </summary>
int ADS_UF_WORKSTATION_TRUST_ACCOUNT = 0x00001000;
/// <summary>
/// This is a computer account for a system backup domain controller
/// that is a member of this domain.
/// </summary>
int ADS_UF_SERVER_TRUST_ACCOUNT = 0x00002000;
/// <summary>
/// The password for this account will never expire.
/// </summary>
int ADS_UF_DONT_EXPIRE_PASSWD = 0x00010000;
/// <summary>
/// This is an MNS logon account.
/// </summary>
int ADS_UF_MNS_LOGON_ACCOUNT = 0x00020000;
/// <summary>
/// The user must log on using a smart card.
/// </summary>
int ADS_UF_SMARTCARD_REQUIRED = 0x00040000;
/// <summary>
/// The service account (user or computer account), under which a
/// service runs, is trusted for Kerberos delegation. Any such service
/// can impersonate a client requesting the service.
/// </summary>
int ADS_UF_TRUSTED_FOR_DELEGATION = 0x00080000;
/// <summary>
/// The security context of the user will not be delegated to a service
/// even if the service account is set as trusted for Kerberos delegation.
/// </summary>
int ADS_UF_NOT_DELEGATED = 0x00100000;
/// <summary>
/// Restrict this principal to use only Data Encryption Standard (DES)
/// encryption types for keys.
/// </summary>
int ADS_UF_USE_DES_KEY_ONLY = 0x00200000;
/// <summary>
/// This account does not require Kerberos pre-authentication for logon.
/// </summary>
int ADS_UF_DONT_REQUIRE_PREAUTH = 0x00400000;
/// <summary>
/// The user password has expired. This flag is created by the system
/// using data from the Pwd-Last-Set attribute and the domain policy.
/// </summary>
int ADS_UF_PASSWORD_EXPIRED = 0x00800000;
/// <summary>
/// The account is enabled for delegation. This is a security-sensitive
/// setting; accounts with this option enabled should be strictly
/// controlled. This setting enables a service running under the account
/// to assume a client identity and authenticate as that user to other
/// remote servers on the network.
/// </summary>
int ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 0x01000000;

Tweet this

May 12th, 2010 8:14 pm | Comments (0)

Active Directory Tip #6 – Set Account never expires

by Tobias Hertkorn on May 10th, 2010

The account never expires checkbox in the MMC is a virtual option. Instead of being a separate property it is set using the accountExpires property. Setting it to the equivalent of 0 will result in an account that never expires.

See Account-Expires Attribute for more details.

PLAIN TEXT

C#:

/// <summary>
/// You still have to call CommitChanges() after using this method.
/// </summary>
private void SetAccountNeverExpires(DirectoryEntry directoryEntry)
{
long accountExpires = 0;
var accountExpiresOriginalValue = directoryEntry.Properties["accountExpires"].Value;
Type type = accountExpiresOriginalValue.GetType();
int highPart = (int)(accountExpires>> 32);
int lowPart = (int)(0xFFFFFFFF & accountExpires);
type.InvokeMember("HighPart", BindingFlags.SetProperty, null, accountExpiresOriginalValue, new object[] { highPart });
type.InvokeMember("LowPart", BindingFlags.SetProperty, null, accountExpiresOriginalValue, new object[] { lowPart });
SetAdObjectAttribute(directoryEntry, "accountExpires", accountExpiresOriginalValue);
}

Tweet this

May 10th, 2010 9:02 pm | Comments (0)

Active Directory Tip #5 – Set Large Integer (e.g. Account expires date)

by Tobias Hertkorn on May 10th, 2010

Setting a large integer property is just as easy.

PLAIN TEXT

C#:

/// <summary>
/// You still have to call CommitChanges() after using this method.
/// </summary>
private void SetAccountExpiresDate(DirectoryEntry directoryEntry, DateTime expiresOn)
{
long accountExpires = expiresOn.ToFileTimeUtc();
var accountExpiresOriginalValue = directoryEntry.Properties["accountExpires"].Value;
Type type = accountExpiresOriginalValue.GetType();
int highPart = (int)(accountExpires>> 32);
int lowPart = (int)(0xFFFFFFFF & accountExpires);
type.InvokeMember("HighPart", BindingFlags.SetProperty, null, accountExpiresOriginalValue, new object[] { highPart });
type.InvokeMember("LowPart", BindingFlags.SetProperty, null, accountExpiresOriginalValue, new object[] { lowPart });
SetAdObjectAttribute(directoryEntry, "accountExpires", accountExpiresOriginalValue);
}

Tweet this

May 10th, 2010 2:00 pm | Comments (0)

Active Directory Tip #4 – Get Large Integer (e.g. Account expires date)

by Tobias Hertkorn on May 4th, 2010

Certain properties, like usnChanged or accountExpires, are in an IADsLargeInteger format. One way to read out the long representation of the value of such a property is by reflection.

PLAIN TEXT

C#:

private static long ConvertLargeIntegerToLong(object largeInteger)
{
Type type = largeInteger.GetType();
int highPart = (int)type.InvokeMember("HighPart", BindingFlags.GetProperty, null, largeInteger, null);
int lowPart = (int)type.InvokeMember("LowPart", BindingFlags.GetProperty | BindingFlags.Public, null, largeInteger, null);
return (long)highPart <<32 | (uint)lowPart;
}

That value may be converted to a DateTime value using the static DateTime.FromFileTimeUtc method.

PLAIN TEXT

C#:

object accountExpires = DirectoryEntryHelper.GetAdObjectProperty(directoryEntry, "accountExpires");
var asLong = ConvertLargeIntegerToLong(accountExpires);
if (asLong == long.MaxValue || asLong <= 0 || DateTime.MaxValue.ToFileTime() <= asLong)
{
return DateTime.MaxValue;
}
else
{
return DateTime.FromFileTimeUtc(asLong);
}

Tweet this

May 4th, 2010 10:58 pm | Comments (0)

Active Directory Tip #3 – Get DirectoryEntry Property with range fetch

by Tobias Hertkorn on May 2nd, 2010

Tip #2 already dealt with one of the problems while using multi-value properties.But there is another pitfall that got me once - and usually only happens in production environments and is very hard to debug. I am talking about property range fetch a mechanism introduced to allow the active directory server to use certain optimizations. Unfortunatelly the optimization means a harder to understand API and more work for us programmer.

When dealing with multi-value properties with a huge number of values the active directory server will only return a certain amount of values on the first access (usually 1500 items). On some properties these values don't have an order so that there is a certain randomness to which values are returned - and therefore a certain randomness if your code works as expected or not. Which makes spotting the problem so hard.

So instead of relying on the fact that directoryEntry.Properties["member"] will return all values one must use the range fetch method using DirectorySearcher in order to get all values for said property. In the code sample below I used a cutoff value to determine if simple access should be trusted or if range fetch (slower) must be used.

PLAIN TEXT

C#:

public static readonly int ATTRIBUTE_RANGE_FETCH_CUTOFF = 500;
public static List<object> GetAdObjectProperties(DirectoryEntry entry, string propertyName)
{
if (entry == null) { throw new ArgumentNullException("entry"); }
if (string.IsNullOrEmpty(propertyName)) { throw new ArgumentException("propertyName"); }
List<object> result = new List<object>();
if (entry.Properties.Contains(propertyName))
{
int count = entry.Properties[propertyName].Count;
if (count == 0)
{
// Nothing to do.
}
if (count == 1)
{
result.Add(entry.Properties[propertyName].Value.ToString());
}
else if (count <ATTRIBUTE_RANGE_FETCH_CUTOFF)
{
foreach (object value in entry.Properties[propertyName])
{
result.Add(value.ToString());
}
}
else
{
return GetAdObjectPropertiesWithRangeFetch(entry, propertyName);
}
}
return result;
}
private static List<object> GetAdObjectPropertiesWithRangeFetch(DirectoryEntry entry, string propertyName)
{
List<object> result = new List<object>();
int index = 0;
int step = entry.Properties[propertyName].Count - 1;
string rangeFormatString = propertyName + ";range={0}-{1}";
string currentRange = string.Format(rangeFormatString, 0, step);
using (DirectorySearcher searcher = new DirectorySearcher(entry, string.Format("({0}=*)", propertyName), new string[] { currentRange }, SearchScope.Base))
{
SearchResult searchResult = FindCurrentRange(searcher, currentRange);
while ((searchResult != null) && searchResult.Properties.Contains(currentRange))
{
foreach (object item in searchResult.Properties[currentRange])
{
if (item != null)
{
result.Add(item);
}
index++;
}
currentRange = string.Format(rangeFormatString, index, (index + step));
searchResult = FindCurrentRange(searcher, currentRange);
}
if (searchResult != null)
{
// final search with '*' as upper limit
string finalRange = string.Format(rangeFormatString, index, "*");
searchResult = FindCurrentRange(searcher, finalRange);
foreach (object item in searchResult.Properties[finalRange])
{
if (item != null)
{
result.Add(item);
}
}
}
return result;
}
}
private static SearchResult FindCurrentRange(DirectorySearcher searcher, string currentRange)
{
searcher.PropertiesToLoad.Clear();
searcher.PropertiesToLoad.Add(currentRange);
SearchResult searchResult = searcher.FindOne();
return searchResult;
}

Tweet this

May 2nd, 2010 10:55 pm | Comments (0)

Active Directory Tip #2 – Get DirectoryEntry Property as object list

by Tobias Hertkorn on April 30th, 2010

Even when you have a directory entry, it's not very easy to interact with it. Especially using the Properties property of the DirectoryEntry class is not as intuitive as I wish it would be. It either acts as a List, when there are more than one value to return, or it acts as a single value property when there is only one value currently set. That means accessing multi value ad properties like the url property through directoryEntry.Properties will act differently depending on how many values are actually set on the active directory entry.

To be save from these kinds of edge-cases it is best to not directly use the Properties property, but instead use a helper function. That way it always behaves like a list.

PLAIN TEXT

C#:

public static List<object> GetAdObjectProperties(DirectoryEntry entry, string propertyName)
{
if (entry == null) { throw new ArgumentNullException("entry"); }
if (string.IsNullOrEmpty(propertyName)) { throw new ArgumentException("propertyName"); }
List<object> result = new List<object>();
if (entry.Properties.Contains(propertyName))
{
int count = entry.Properties[propertyName].Count;
if (count == 0)
{
// nothing to do
}
else if (count == 1)
{
result.Add(entry.Properties[propertyName].Value);
}
else
{
foreach (object value in entry.Properties[propertyName])
{
result.Add(value);
}
}
}
return result;
}

Unfortunatelly this is not all that needs to be observed while reading properties. Make sure to check out Tip #3 to find out more.

Tweet this

April 30th, 2010 10:54 pm | Comments (0)

Active Directory Tip #1 – DirectoryEntry.Exists with authentication

by Tobias Hertkorn on April 28th, 2010

When checking, if an entry in the Active Directory exists, usually I would use the static DirectoryEntry.Exists method. Unfortunatelly it does not provide an overload that lets me specify an username and password. But that's easily fixed. Just check for the error code "no such object" in the COMException that is thrown in case of a Ldap path that points to no existing object.

PLAIN TEXT

C#:

public static bool Exists(string ldapPath, string username, string password)
{
return GetDirectoryEntry(ldapPath, username, password) != null;
}
private static readonly int ERROR_DS_NO_SUCH_OBJECT = -2147016656;
public static DirectoryEntry GetDirectoryEntry(string ldapPath, string username, string password)
{
DirectoryEntry de = new DirectoryEntry();
de.Path = ldapPath;
de.Username = username;
de.Password = password;
de.AuthenticationType = AuthenticationTypes.Secure;
try
{
if (de.NativeObject == null)
{
// No AD object found!
de.Close();
de = null;
}
}
catch (COMException exception)
{
// 0x80072030 ERROR_DS_NO_SUCH_OBJECT
// http://msdn.microsoft.com/en-us/library/aa746386.aspx
if (exception.ErrorCode != ERROR_DS_NO_SUCH_OBJECT)
{
throw;
}
de.Close();
de = null;
}
return de;
}

Tweet this

April 28th, 2010 10:59 pm | Comments (2)

Active Directory Tips – The series

by Tobias Hertkorn on April 28th, 2010

I am currently digging into old automation code for active directory object CRUD. Unfortunatelly there are certain pitfalls and weird edge-cases surrounding the use of DirectoryEntry. So in order to save me the research in future projects and maybe help you I am starting a small series focusing on those pitfalls and edge-cases. I call them "tips" because it will be mostly code and less explanation of the code. Feel free to use the comments if you have further questions concerning the code. Just remember: If you have a question chances are somebody wants the answer as well.

Tweet this

April 28th, 2010 10:51 pm | Comments (0)

« Previous Entries

Tobi + C# = T#

Active Directory Tip #9 – How to escape the Path property

Active Directory Tip #8 – Set Password of user

Active Directory Tip #7 – Handling a Bit Property (e.g. userAccountControl – Account is disabled)

Active Directory Tip #6 – Set Account never expires

Active Directory Tip #5 – Set Large Integer (e.g. Account expires date)

Active Directory Tip #4 – Get Large Integer (e.g. Account expires date)

Active Directory Tip #3 – Get DirectoryEntry Property with range fetch

Active Directory Tip #2 – Get DirectoryEntry Property as object list

Active Directory Tip #1 – DirectoryEntry.Exists with authentication

Active Directory Tips – The series

About

Pages

Links

Top Searches

Categories

Archives

Meta