Finding all groups that a user manages

We got a special multivalue attribute. Let's call it ourOwnManagedBy which can contain users or groups (their DN) that manages the current group.

How can I retrieve a list of all groups that a specific user manages (with the help of managedBy and ourOwnManagedBy)?

For instance. Let's say that the user is member of the group GlobalAdministrators and that the group ApplicationAdministrators has GlobalAdministrations as a member. And finally the group MyApplication which has ApplicationAdministrators in the ourOwnManagedBy attribute.

User is member of GlobalAdministrators
GlobalAdministrators is member of ApplicationAdministrators
MyApplication got ApplicationAdministrators in ourOwnManagedBy

How do I use that information to find all groups that a specific user manages? Is it possible to do some kind of recursive check in custom attributes (that contains DNs of users and groups)?

Update

I've tried to use a directory search filter like this:

string.Format("(ourOwnManagedBy:1.2.840.113556.1.4.1941:={0})", dn);

but I might have missunderstood what 1.2.840.113556.1.4.1941 does? (MSDN page)

c# active-directory ldap

Edit Report

1 Answer

No recursion, no idea on how it will do performance wise, may have bugs.

        string user = "username";
        //get domain
        DirectoryEntry de = System.DirectoryServices.ActiveDirectory.Domain.GetCurrentDomain().GetDirectoryEntry();
        //get users dn first
        string userDN;
        using (var searcher = new DirectorySearcher(de))
        {
            searcher.Filter = String.Format("(&(objectCategory=person)(objectClass=user)(sAMAccountName={0}))", user);
            searcher.PropertiesToLoad.Add("distinguishedName");
            userDN = searcher.FindOne().Properties["distinguishedName"][0].ToString();
        }

        //get list of all users groups
        List<string> groups;
        //see http://stackoverflow.com/questions/6252819/find-recursive-group-membership-active-directory-using-c-sharp
        using (var searcher2 = new DirectorySearcher(de))
        {
            searcher2.Filter = String.Format("(member:1.2.840.113556.1.4.1941:={0})", userDN);
            searcher2.SearchScope = SearchScope.Subtree;
            searcher2.PropertiesToLoad.Add("distinguishedName");

            SearchResultCollection src = searcher2.FindAll();

            groups = (from SearchResult c in src
                      select c.Properties["distinguishedName"][0].ToString()).ToList();
        }

        //build giant search query
        SearchResultCollection srcGroups;
        using (var searcher = new DirectorySearcher(de))
        {
            string baseString = "(|{0})";
            string managedbybase = "(managedBy={0})";
            //I've read that you can search multivalued lists using a standard ='s.
            string ourOwnManagedByBase = "(ourOwnManagedBy={0})";

            StringBuilder sb = new StringBuilder();

            //add user DN to list of group dn's
            groups.Add(userDN);

            foreach (string g in groups)
            {
                sb.AppendFormat(managedbybase, g);


                        
                        
                            answered 2012-08-30T16:51:00.167

Finding all groups that a user manages

1 Answer

Your Answer