Check if user authentication is active Active Directory

Question

I would like to know if the user is entering the correct combination of Domain, User and Password for their Active Directory user.

I tried to make a very simple program that cannot connect, but by reading the error message, I can find out if the user / password is correct.

This is a trick (the logic is to read the exception message), anyway, I tested this prototype on two servers, and I noticed that the exclusion messages change from server to server, so this is unreliable.

uses adshlp, ActiveDs_TLB;
// 3 TEdit and a TButton

procedure TForm4.Button1Click(Sender: TObject);
Var
 aUser : IAdsUser;
 pDomain, pUser, pPassword : string;
 myResult : HRESULT;
 Counter: integer;
begin
  pDomain := edtDomain.Text;
  pUser:= edtUser.Text;
  pPassword := edtPwd.Text;
  Counter := GetTickCount;


 Try
    myResult := ADsOpenObject(Format('LDAP://%s',[pDomain]),Format('%s\%s',[pDomain,pUser]),pPassword,
    ADS_READONLY_SERVER,
    IAdsUser,aUser);
 except
    On E : EOleException do
    begin
    if (GetTickCount - Counter > 3000) then  ShowMessage ('Problem with connection') else
    if Pos('password',E.Message) > 0  then ShowMessage ('wrong username or password') else
     if Pos('server',E.Message) > 0 then ShowMessage ('Connected') else
     ShowMessage('Unhandled case');
    memLog.Lines.Add(E.Message);
    end;

 end
end;

, "", "" , , ( ldap-), (, ), " ", "" , " ". SInce , "" "" . , , .

, .

, , ?

UPDATE ( )

, , . , , , , :

// This function returns True if the provided parameters are correct
// login credentials for a user in the specified Domain
// From empirical tests it seems reliable
function UserCanLogin(aDomain, aUser, aPassword: string): Boolean;
var
  hToken: THandle;
begin
  Result := False;
  if (LogonUser(pChar(aUser), pChar(aDomain), pChar(aPassword), LOGON32_LOGON_INTERACTIVE,
   LOGON32_PROVIDER_DEFAULT, hToken)) then
  begin
    CloseHandle(hToken);
    Result := True;
  end;
end;

Answer 1

, , Active Directory.

LogonUser , .

  if (LogonUser(pChar(_Username), pChar(_ADServer), pChar(_Password), LOGON32_LOGON_INTERACTIVE,
   LOGON32_PROVIDER_DEFAULT, hToken)) then
  begin
    CloseHandle(hToken);
    //...
    //DoSomething
  end
  else raise Exception.Create(SysErrorMessage(GetLastError));

. LogonUser , The user name or password is incorrect

TLDAPSend, .

function _IsAuthenticated(const lpszUsername, lpszDomain, lpszPassword: string): Boolean;
var
  LDAP : TLDAPSend;
begin
  Result := False;
  if ( (Length(lpszUsername) = 0) or (Length(lpszPassword) = 0) )then Exit;
  LDAP := TLDAPSend.Create;
  try
    LDAP.TargetHost := lpszDomain;
    LDAP.TargetPort := '389';
    ....
    LDAP.UserName := lpszUsername + #64 + lpszDomain;;
    LDAP.Password := lpszPassword;
    Result := LDAP.Login;
  finally
    LDAP.Free;
  end;
end;

, ? ?

FormatMessage

 FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER or FORMAT_MESSAGE_FROM_SYSTEM,
                nil,
                myResult,
                LANG_ENGLISH or SUBLANG_ENGLISH_US,
                lpMsg,
                0,
                nil);
 MessageBox(0, lpMsg, 'Msg', 0);

Answer 2

, ADsOpenObject. .

, S_OK, ADSI Error Codes, , LDAP ADSI

LDAP , LDAP.

Win32 ADSI. , - WIN32 0x80072020.

LDAP ADSI

• 8007 WIN32. 2020.
• . 2020 8224.
• WinError.h . 8224L ERROR_DS_OPERATIONS_ERROR.
• ERROR_DS LDAP _. LDAP_OPERATIONS_ERROR.
• Winldap.h LDAP. LDAP_OPERATIONS_ERROR Winldap.h 0x01.

0x8007052e (0x052e= 1326) ERROR_LOGON_FAILURE

---

:

,

EOleException, ADsOpenObject safecall. stdcall. safecall Delphi EOleException, HResult EOleException.ErrorCode, (stdcall) , HResult ADsOpenObject .

Answer 3

(HRESULT) 0x8007052e (2147943726) " ", . EOleException , :

      hr := ADsOpenObject('LDAP://'+ ADomain + '/OU=Domain Controllers,' + APath,
                       AUser, APwd,
                       ADS_SECURE_AUTHENTICATION or ADS_READONLY_SERVER,
                       IID_IADs, pObject);
   if (hr=HRESULT(2147943726)) then ShowMessage ('wrong username or password')