Check if List of Users are valid against adfs in C

Question

I have a requirement to check if the users in my application are active users in active directory. I need to send a notification when one of the user alias becomes invalid.

In most of the examples I see validating only one user at a time against ADFS using LDAP which is going to take a very long time large number of users.

Is there any way by which I can validate by sending a list of users and validate, so that it will be faster?

Thanks.

Answer 1

Starting with .Net 3.5 there's System.DirectoryServices.AccountManagement

I'd code something like

public List<string> InvalidUsernames (List<string> usernames)
{
    var result = new List<string>();
    var domainName = "OkieDokie";
    var ldapContext = new PrincipalContext(ContextType.Domain, domainName);
    foreach (var username in usernames)
    {
        var user = UserPrincipal.FindByIdentity(ldapContext, username);
        if (user == null) //null means it couldn't be found
        {
            result.Add(username);
        }
    }
    return result;
}

But it all depends on what you consider active/invalid. In the if you could check for the user.AccountExpirationDate (?date) or user.Enabled (?bool).

Or if you do have a common group for all of them, you could replace the previous foreach and use:

var usersGroup = UsernamesInGroup("theONEgroup");
foreach (var username in usernames)
{
    var user = UserPrincipal.FindByIdentity(ldapContext, username);
    if (user == null) //null means it couldn't be found
    {
        result.Add(username);
    }
}

public List<string> UsernamesInGroup(string groupName)
{
    GroupPrincipal grupo = GroupPrincipal.FindByIdentity(MainOU, groupName);
    return UsernamesInGroup(group);
}

public List<string> UsernamesInGroup(GroupPrincipal gp)
{
    List<string> userNames = new List<string>();
    var principalsInGroup = gp.GetMembers(true);
    foreach (Principal principal in principalsInGroup)
    {
        if (principal.StructuralObjectClass == "user")
        {
            userNames.Add(principal.SamAccountName);
        }
    }
    return userNames;
}

Answer 2

Out the box in ADFS, no.

This sounds like something you should call from your app. using the AD C# API's.

Refer Howto: (Almost) Everything In Active Directory via C#.

Or (in some cases) Everything in Active Directory via C#.NET 3.5 (Using System.DirectoryServices.AccountManagement)