Get users of AD group for use in SharePoint webpart.

Welcome to my first technical posting.

My task here was simple, create a web part that displays the users of an Active Directory OU (Organizational Unit or group basically) which will have been added to a SharePoint site. This is our model internally going forward on how we are managing access to sites within our farm, so basically every site will only have one member... an AD group. This way we can manage (or let someone else manage) access through AD.

I won't get into how to create a web part in this post (you can start here if you like), but more of the guts of what I used to get what I needed out of .NET in a web part. This is really basic to the rendered output is nothing fancy.

Basically I got the site's userlist from the site context, iterated the user list, checked to see if the user was a group, if so, called code to give me the AD users of that group and output the user list.
First add a reference to:
System.DirectoryServices.AccountManagement;

Here's the code:
First: this code was inside the
protected override void CreateChildControls() function.

string currentUrl = System.Web.HttpContext.Current.Request.Url.ToString();
SPSecurity.RunWithElevatedPrivileges(
delegate()
{
using (SPSite site = new SPSite(currentUrl))
{
SPWeb web = site.OpenWeb();
SPGroupCollection grps = web.Groups;
foreach (SPGroup group in grps)
{
if (group.Name == web.AssociatedMemberGroup.ToString()) //This gets the users/group from the current site
{
Controls.Add(new LiteralControl("" + group.Name + "
"));
foreach (SPUser user in group.Users)
{
if (user.IsDomainGroup)
{
string groupName = user.Name.Remove(0,5);
using (PrincipalContext ctx = new PrincipalContext(ContextType.Domain, domainName))
{
if (ctx != null)
{
GroupPrincipal gp = GroupPrincipal.FindByIdentity(ctx, IdentityType.Name, groupName);
if (gp != null)
{
foreach (Principal p in gp.GetMembers(true))
{
Controls.Add(new LiteralControl(p.Name + "
")); ....(bracketd removed for brevity)

Sorry for the lame code spit out, I'm still new to blogspot.
One thing I wanted to point out here was:

string groupName = user.Name.Remove(0,5); You can manipulate the string however you like (Substring etc.) but what took me a while to figure out was that GroupPrincipal.FindByIdentity expects the group name without the domain\ prefix, so in my case my domain name is only four letters and a '\'. This took me way too long to figure out, and no offence to M$, but sometimes the documentation just doesn't specify that in easy to understand terms.

Also, here's a link to Brad Rutkowski's blog where I found the base code for getting members out of a group.

Hope this helps someone out there.

-Eric

Comments

Post a Comment

Popular posts from this blog

SharePoint 2010: Adding List Attachments as Links in a DataView Webpart

Image
As silly as it seems to me, providing links to list attachments in a data view is still not an OOB option in SharePoint 2010. I read a lot about how you should just use document libraries instead, and while that may be a better option in some ways, it doesn't always provide the best user experience, especially when you want to provide a non technical user a way to have files associated with a custom list item, or in my case, as Task List item. The only OOB way to link a list to a document library such that you could later provide a filtered view of the documents was to link up some sort of common data point (such as a project number, or a list item ID number). While that's not a big deal usually, the goal to achieve as little effort for the end user is always paramount in my firm. Feel free to comment on how best to automatically link an item(s) to a document library without custom code or a third party solution. For me, the easiest thing for my users, is to simply attach to th...
Read more

A simple method for finding Active Directory user information using C# with LDAP

I spent hours trying to find a simple way to get user data our of AD from an LDAP query. Turns out you don't need to do a lot of crazy stuff, and looking at my code when I was done, it turned out to be a lot easier than it seemed when I started out. The only thing I need to pass in to my function was the name of the property ( see the list here ), and the username. In my case it was coming from some other logic I had to write to get the users of a group that was a member of a SharePoint site. Also the ldapPath I pass in to the DirectorySearcher constructor was simply "LDAP://mydomain.com" This returns the value of the property of the user that you specify as a string. Example: getValidADProps("mail", "Ima User") will return the AD email address for Ima User. In the function, I used a try/catch in the instance that the property you are trying to find isn't there, you will get a index out of range error. I will say that this is not the more lightweig...
Read more