How to query Active Directory B if the application server is in Active Directory A

Question

So my question. I have an Asp.net application with forms-based authentication. I have users in my database, but users must also be in the active directory.

The following code is for checking whether a user is in domain A

DirectoryEntry de = new DirectoryEntry(); de.Path = "LDAP://domainA.com"; de.AuthenticationType = AuthenticationTypes.None; DirectorySearcher search = new DirectorySearcher(de); search.Filter = "(SAMAccountName=" + account + ")"; search.PropertiesToLoad.Add("displayName"); SearchResult result = search.FindOne(); 

This code is working fine. The problem is that the client requests that domain B can also connect to the application. Thus, the following code was created:

  DirectoryEntry de = new DirectoryEntry(); de.Path = "LDAP://domainB.com"; de.AuthenticationType = AuthenticationTypes.None; DirectorySearcher search = new DirectorySearcher(de); search.Filter = "(SAMAccountName=" + account + ")"; search.PropertiesToLoad.Add("displayName"); SearchResult result = search.FindOne(); 

Since my server is in domainA, this does not work. Is there a way for me to query domainB, knowing that the server is in domainA? I found an article where you need to configure trust for domains A and B, but these domains should not be connected. Its only for this application that they need this functionality.

PS I could forget to explain an important detail. domainA and B are not on the same network. But domainA can ping domainB

Answer 1

You will need to provide credentials that have permission to query AD for domain B.

 var de = new DirectoryEntry("LDAP://domainB.com", "Username", "Password"); var search = new DirectorySearcher(de); 

Answer 2

When trying samples in a foreign domain, I noticed that the external DC reports a "Server Unavailable" error when using the wrong authentication type. Try:

 de.User = @"DOMAINB\user"; de.Password = "YourPassword"; de.AuthenticationType = AuthenticationTypes.None; 

Of course, this leads to an insecure, simple BASIC connection that removes any encryption that ADSI can offer. If this works, you should try the more secure authentication type that the server accepts.

An alternative would be to use the System.DirectoryServices.Protocols namespace, which offers an easier approach for accessing AD. I can provide you with a sample that you want to go in this direction.