We Keep Coding

Given user id, password, and a subdomain name, how can I obtain the top-level domain name for a user account?

I'm writing a program (WinForms, C#) that runs on a Win 7 client machine. It obtains credentials from the user (user id, password, and subdomain name) and uses them to authenticate (via Active Directory) to other servers to which the program remotely connects. The other servers are on a domain different than the domain the Win 7 client machine is on.
Using the NetworkCredential, LdapDirectoryIdentifier, and LdapConnection classes, I can test the credentials with no more than the user id, password, and subdomain name (See answer for S.O. Why does Active Directory validate last password?).
For example, for the user account ssmith#xyz.gov, I need only provide ssmith (user id), the password for ssmith, and xyz (the subdomain). I don't need to provide the top-level domain name (gov in this case).
Now, I want to programmatically obtain the top-level domain name for this user account (gov in this case). I've examined the properties and methods of the NetworkCredential, LdapDirectoryIdentifier, and LdapConnection classes. I've looked over the other classes in the System.DirectoryServices.Protocols Namespace. I don't see a way to programmatically obtain the top-level domain name.
Given user id, password, and subdomain name, how can I obtain the top-level domain name for a user account?
Here is my code. Given a user account of ssmith#xyz.gov, My call looks like this (asterisks represent a SecureString password)
bool result = ValidateCredentials("ssmith","******", "xyz");
Here is my code for the method.
private const int ERROR_LOGON_FAILURE = 0x31;
private bool ValidateCredentials(string username, SecureString ssPassword, string domain)
{
//suports secure string
NetworkCredential credentials = new NetworkCredential(username, ssPassword, domain);
LdapDirectoryIdentifier id = new LdapDirectoryIdentifier(domain);
using (LdapConnection connection = new LdapConnection(id, credentials, AuthType.Kerberos))
{
connection.SessionOptions.Sealing = true;
connection.SessionOptions.Signing = true;
try
{
// The only way to test credentials on a LDAP connection seems to be to attempt a
// Bind operation, which will throw an exception if the credentials are bad
connection.Bind();
}
catch (LdapException lEx)
{
credentials = null;
id = null;
if (ERROR_LOGON_FAILURE == lEx.ErrorCode)
{
return false;
}
throw;
}
}
credentials = null;
id = null;
return true;
}

After a successful bind, then the full DNS name of the domain will be in the LdapConnection object:
var domain = connection.SessionOptions.DomainName;
In this case, that would be "xyz.gov". If you need just "gov", then you can just take everything after the last dot:
var tld = domain.Substring(domain.LastIndexOf('.') + 1);

LDAP C# error when trying to connect

I keep getting the following error when trying to connect to an LDAP server. The user name or password is incorrect.
It occurs on the .FindOne()
If I use AuthenticationTypes.Encryption i get an error: The server is not operational.
I've also tried to prepend the username with ownme\username
I'm extremely newbish with AD so the issue might be so simple.
Domain = domain;
_entry = new DirectoryEntry("LDAP://DC1/DC=ownme,DC=local", username, password, AuthenticationTypes.ServerBind);
_directorySearcher = new DirectorySearcher(_entry, "(objectClass=*)", new string[] {"namingContexts"}, SearchScope.Subtree);
var namingContext = _directorySearcher.FindOne();

The problem was credentials. You need to specify the domain prefix in the username or look at one of the comments in my question.
I had var username = "domain\username";
I should have written var username = #"domain\username";

Connect to Active Directory using credential

I'm trying to connect to AD sever using C#. This is my first time playing with AD.Domain I need to connect to is abc.def.com.
This is a ASP.NET web site and it gives this error. But I can log in to same domain using "ldp.exe" by using same credential. Anyone have idea?
[DirectoryServicesCOMException (0x8007052e): Logon failure: unknown user name or bad "password.
]
System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) +387825
System.DirectoryServices.DirectoryEntry.Bind() +36
System.DirectoryServices.DirectoryEntry.get_AdsObject() +31
This is my code
static System.DirectoryServices.DirectoryEntry createDirectoryEntry()
{
System.DirectoryServices.DirectoryEntry ldapConnection = new System.DirectoryServices.DirectoryEntry("13.18.12.16", "Administrator", "admin123");
ldapConnection.Path = "LDAP://ou=Users,dc=abc,dc=def,dc=com";
ldapConnection.AuthenticationType = System.DirectoryServices.AuthenticationTypes.Secure;
return ldapConnection;
}
System.DirectoryServices.DirectoryEntry sgscAd = createDirectoryEntry();
System.DirectoryServices.DirectorySearcher search = new System.DirectoryServices.DirectorySearcher(sgscAd);
search.Filter = "(cn=" + m_username + ")";
System.DirectoryServices.SearchResult result = search.FindOne();

The LDAP path to the users container is not correct.
The users container is not an organizational unit but a simple container.
So, you have to specify a different LDAP path.
The LDAP path to the users container in your case is:
LDAP://cn=Users,dc=abc,dc=def,dc=com
Also consider what Hall72215 mentioned in his answer. Use the whole LDAP path directly in the constructor of the DirectoryEntry class.

Why are you giving one path in the constructor (13.18.12.16), and another by setting the Path property? Have you tried giving all of the information in the constructor?
static DirectoryEntry createDirectoryEntry()
{
string username = "Administrator";
string password = "admin123";
string path = "LDAP://13.18.12.16/OU=Users,DC=abc,DC=def,DC=com";
AuthenticationTypes authType = AuthenticationTypes.Secure | AuthenticationTypes.ServerBind;
return new DirectoryEntry(path, username, password, authType);
}
Is Administrator a user in the domain of the domain controller at 13.18.12.16?

The LDAP server is unavailable

I'm a total newbie to this
Trying to connect to an ldap server with PrincipalContext. I have tried all solutions on this site to no avail.
Things I've tried:
PrincipalContext insPrincipalContext =
new PrincipalContext(ContextType.Domain);
PrincipalContext insPrincipalContext =
new PrincipalContext(ContextType.Domain, "ldap://localhost:389/dc=maxcrc,dc=com");
PrincipalContext insPrincipalContext =
new PrincipalContext(ContextType.Domain, "maxcrc.com");
All give the same result:
LDAP server not available
Only ContextType.Machine works basically.
Not sure if my LDAP server is set up correctly:
Host: localhost
Port: 389
Base DN: dc=maxcrc,dc=com
URL: ldap://localhost:389/dc=maxcrc,dc=com
Testing with Softerra LDAP Browser
Any tutorials from start to finish will be much appreciated...

I have been facing the same issue and I found a solution.
I'm able to connect easily using following code:
ADUser_Id = "domainName\\username"; //make sure user name has domain name.
Password = "xxxx";
var context = new PrincipalContext(ContextType.Domain,"server_address", ADUser_Id,Password);
/* server_address = "192.168.15.36"; //don't include ldap in url */

I had similar issues. It turned out that I had to pass username and password in the object initialization. Please try using a statement like below:
PrincipalContext insPrincipalContext =
new PrincipalContext(ContextType.Domain,
"ldap://localhost:389/dc=maxcrc,dc=com",
userName,
password);
Also make sure that your username has domain in it.
For example,
userName = "mydomainname" + "\\" + "john_jacobs"

Use the following constructor overload for PrincipalContext:
public PrincipalContext(
ContextType contextType,
string name,
string container
)
And separate the server name from the LDAP string:
PrincipalContext insPrincipalContext =
new PrincipalContext(ContextType.Domain, "localhost:389", "dc=maxcrc,dc=com");
https://msdn.microsoft.com/en-us/library/bb348316%28v=vs.110%29.aspx

In my environment I had to create the principal context with just the domain controller host name, and then separately validate the user credentials.
string domainControllerName = "PDC";
string domainName = "MyDomain"; // leave out the .Local, this is just to use as the prefix for the username if the user left it off or didn't use the principal address notation
string username = "TestUser";
string password = "password";
using (var ldap = new PrincipalContext(ContextType.Domain, domainControllerName))
{
var usernameToValidate = username;
if (!usernameToValidate.Any(c => c == '#' || c == '\\'))
usernameToValidate = $"{domainName}\\{username}";
if (!ldap.ValidateCredentials(username, context.Password, ContextOptions.SimpleBind))
throw new UnauthorizedException();
}
This example allows for all three of these variations to the username to validate:
TestUser
MyDomain\TestUser
TestUser#MyDomain.Local

You may want to try your local machine address instead :
ldap://127.0.0.1:389/dc=maxcrc,dc=com
If that doesn't work, I'd fire up Wireshark, and have it capture traffic on port 389 as you're attempting to connect via Softerra.
In my time working with LDAP and .Net DirectoryServices, that error usually means the syntax or naming convention of the path is incorrect, or does not point to a valid directory end point.

That error might be due to trying to connect as "Anonymous" without specifying it explicitly.
By default all connections are Negotiable. So if you try something like that you could try the following:
LdapDirectoryIdentifier ldap = new LdapDirectoryIdentifier("My Hostname or IP Address",10389); //10389 might be your non default port
LdapConnection connection = new LdapConnection(ldap);
connection.AuthType = AuthType.Anonymous;

Retrieving all user accounts on an accessible external Active Directory server over LDAPS

I need to connect to an external LDAP server that is accessible to me but only over LDAPS.
The information I have available is username, server, password. I need to query and retrieve a list of all users. The format I have the details in are
Username: domain\username
Password: {password}
Domain: remote.{domain}.net.au
The following code I wrote will authenticate my user account successfully, but I now need to enumerate all users which is where I'm having issues. Ideally this would be ALL users in the directory, not from within a specific OU. Again, I don't have the fully qualified paths to any OUs for this server. The server has a self signed certificate which is why in my example I am specifically telling it to accept the certificate.
int port = secured ? 636 : 389;
LdapConnection connection = new LdapConnection(new LdapDirectoryIdentifier(ldapServer, port, false, false));
if (secured)
{
connection.SessionOptions.ProtocolVersion = 3;
connection.SessionOptions.SecureSocketLayer = true;
}
connection.Credential = new NetworkCredential(username, password);
connection.AuthType = AuthType.Basic;
connection.SessionOptions.VerifyServerCertificate += (conn, cert) => { return true; };
connection.Bind();
return connection;

So the answer is in Performing a Simple Search sample of Introduction to System.DirectoryServices.Protocols (S.DS.P) with :
// create a search filter to find all objects
string ldapSearchFilter = "(&(objectCategory=person)(objectClass=user))";