I modified the following method in LdapHelper.cs file and verified that the code is working with rootDN or OU specified. For AD LDAP, the current code ignores the rootDN setting. Also it does not seem to search the login user in the result. Successful getting adentry does not mean the user is in that OU. In AD, basically any user can read the AD structure. The code does not search the security group in an OU. Need more work to fix that.
=======================================
private static LdapUser ActiveDirectoryLogin(LdapSettings ldapSettings, string uid, string password)
{
bool success = false;
LdapUser user = null;
DirectoryEntry adentry = null;
//Note: Not necessary to check SSL. Default authentication type for .NET 2.0+ is "Secure"
try
{ //add rootDN to limit to certain OU
//adentry = new DirectoryEntry("LDAP://" + ldapSettings.Server, ldapSettings.Domain + "\\" + uid, password);
log.Error("try to connect to ldap server with Server: " + ldapSettings.Server + "; RootDN: " + ldapSettings.RootDN + "; UID=" + uid);
adentry = new DirectoryEntry("LDAP://" + ldapSettings.Server + "/" + ldapSettings.RootDN, ldapSettings.Domain + "\\" + uid, password);
}
catch (System.Runtime.InteropServices.COMException ex)
{
if (log.IsErrorEnabled)
{
log.Error("couldn't connect to ldap server with Server: " + ldapSettings.Server + "; RootDN: " + ldapSettings.RootDN + "; UID=" + uid, ex);
}
}
if (adentry != null)
{
//Bind to the native AdsObject to force authentication.
try
{
object testobj = adentry.NativeObject;
success = true;
}
catch (System.Runtime.InteropServices.COMException ex)
{
if (log.IsErrorEnabled)
{
log.Error("LDAP login failure", ex);
}
success = false;
}
if (success && adentry != null)
{
//check if user exists in OU
DirectorySearcher ds = new DirectorySearcher(adentry);
ds.Filter = "(&(sAMAccountName=" + uid + "))";
SearchResult result = ds.FindOne();
if (result != null)
{
log.Error("successful authentication to ldap server in OU with Server: " + ldapSettings.Server + "; RootDN: " + ldapSettings.RootDN + "; UID=" + uid);
user = new LdapUser(adentry, uid, ldapSettings);
}
else
{
log.Error("failed authentication to ldap server in OU with Server: " + ldapSettings.Server + "; RootDN: " + ldapSettings.RootDN + "; UID=" + uid);
//potentially look in the security group
}
}
}
return user;
}