Enumerating groups using WindowsIdentity.GetCurrent () returns the old set of groups

Question

I have a user who, when I try to list her groups, using either System.Security.Principal.WindowsIdentity.GetCurrent().Groups on the user's computer or System.Web.HttpContext.Current.Request.LogonUserIdentity.Groups on the IIS server, I get a list of my old groups, not their new ones.

I checked the DC for which they are authenticated and the ASP.NET page is launched inside the SharePoint instance, so it is most likely that LogonUserIdentity is provided from there by Kerberos.

Should I search for groups directly from AD instead of relying on WindowsIdentity or LogonUserIdentity?

Answer 1

If you use WindowsIdentity or LogonUserIdentity , it will collect group information from the authorization information stored on the Kerberos Ticket (TGT).

This is powerful and useful, because once you are authenticated and receive Kerberos TGT, you do not need to query Active Directory again to get all the group information. Listing groups is actually quite expensive and complicated. Therefore, the Kerberos cache approach is preferable, and this approach is used when accessing any Windows resources.

However, this also means that after adding a user account to a group, the WindowsIdentity or LogonUserIdentity approach will not know the new groups. You must clear your Kerberos ticket and get it again. You can log out and then log in, or you can lock your screen and enter a password to unlock the screen.

If for some reason you still want to enumerate the groups yourself, I recommend using UserPrincipal.GetAuthorizationGroups in .NET 3.5. It returns all security groups to which the user belongs.