Tuesday, 20 September 2005

Expanding Group Membership in .NET 2.0

We have some new options available to us in .NET 2.0 to discover a user’s group membership.  I ran into an entry on Dominick’s blog about expanding group membership using the new IdentityReference class.  This technique assumes you can get a WindowsIdentity for the user you wish to expand.  I previously covered two other techniques here and here.

I use yet another 3rd technique similar to this in the book that actually takes the ‘tokenGroups’ attribute for any user in AD and expands the membership using the IdentityReference.  It is the most elegant of the 3 methods, IMO.

One note on Dominick’s code: a way to further optimize this is to use .Translate on the IdentityReferenceCollection so that the call is batched under the hood.

Tuesday, 04 October 2005 18:09:41 (Eastern Daylight Time, UTC-04:00)
RP - your blog rules!
Tuesday, 11 October 2005 16:14:16 (Eastern Daylight Time, UTC-04:00)

how exactly do you want to optimize the code??

Tuesday, 11 October 2005 16:47:05 (Eastern Daylight Time, UTC-04:00)
Hi Dominick,

List /string/ getGroups(WindowsIdentity id)
List/string/ groups = new List=/string/();
IdentityReferenceCollection irc = id.Groups.Translate(typeof(NTAccount));

foreach (NTAccount nt in irc)
return groups;

Simply call the .Translate from the IdentityReferenceCollection similar to above. This should batch your call instead of making multiple calls in the foreach loop, IIRC.

Sorry, comments won't allow angle brackets, so they are replaced above.
Tuesday, 11 October 2005 17:10:19 (Eastern Daylight Time, UTC-04:00)
but under the covers, this is the same code, right?
Wednesday, 12 October 2005 10:15:39 (Eastern Daylight Time, UTC-04:00)
If you mean does the same code run, then the answer is yes, of course. However, the conversion from SID to NT Account format is done using the LsaLookupSids API call. This call takes an array of SIDs. So, if you supply an array of SIDs (by calling Translate() from the collection) it will do the conversion in one call. If you put it in a loop, it must make the call n times with exactly 1 item in the array to be converted. The designers were smart in their implementation, and I suspect that is the sole purpose of putting the .Translate() method on the collection to begin with. Sorry if I was being confusing.
Comments are closed.