Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two domains A and B

Domain A contains a security-group SEC. This group is used to access a web application. The group is a security group, and the type of the group is domain local. This domain also contains most of the users.

Domain B contains a few users, and these users are direct members of the security group located in domain A

In my web application (ASP.NET MVC) i use the integrated windows auth provider, which checks if a user is a member of the security group. Afterwards i locate the user in active directory, and assigns the user a bunch of roles based on what active directory groups they are a member of.

When querying the tokengroups property on the users from domain A i can see they are member of the SEC group.

But when querying the members of domain B, also by using the tokengroups property, I do not see the SEC group in the tokengroups property.

My questions

  • Why do the members in domain B seems to not be a member of the group, when they really are? I use the tokengroups property when looking up groups on a user.

    The reason i belive they are is because i can see the users in the list of members when looking at the properties of the group. Furthermore, they are authenticated in the web application, but when my module tries to find the groups of the members from domain B, the SEC group is just not there.

  • Is the current setup with all the groups being security groups, and domain local, really the best way? What I need is a bunch of "marker" groups that i can add groups and users to, from multiple domains.

To get the security groups of a user, i use the tokengroups property. Like this http://tutorials.csharp-online.net/User_Management_with_Active_Directory%E2%80%94Retrieving_the_Users_Token_Groups

share|improve this question
    
Your query is LDAP, not the GC? –  Greg Askew Sep 12 '13 at 11:28
    
I'm not sure what you mean? The way i (try to) find the groups on a user, is by refreshing the DirectoryEntry after finding the user by his or her username. And then looking in the TokenGroups property on the user. This works, but the result is missing the SEC group when doing this on the user from domain B. –  Moulde Sep 12 '13 at 12:52
    
DirectoryEntry.Path - does it start with LDAP:// or GC:// ? –  Greg Askew Sep 12 '13 at 13:40
    
Yes, it starts with LDAP:// –  Moulde Sep 12 '13 at 19:39
add comment

1 Answer

I think you need to bind to a GC to correctly retrieve tokenGroups from Active Directory. i.e. in your bindstring, you should replace LDAP:// with GC:// and hopefully this should then work.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.