C# 使用不同的用户凭据访问活动目录

问题描述

我们刚刚为用户提供了一个新的用户创建应用程序.然而，这些用户需要能够通过应用程序创建用户，即使他们自己没有创建用户的权限.

There is a new user creation application that we have just provided our users. However these users need the ability to creation users through the application even though they themselves do not have permission to create users.

在 C# 中，您如何模拟其他用户以获得此功能.此应用程序主要使用 System.DirectoryServices.

In C# how do you impersonate another user in order to have this functionality. This application primary using System.DirectoryServices.

代码片段:

DirectoryEntry dEntry = new DirectoryEntry("LDAP://OU=");
DirectorySearcher dSearcher = new DirectorySearcher(dEntry);
//filter just user objects
dSearcher.SearchScope = SearchScope.Subtree;
dSearcher.Filter = "(&(objectClass=user)(mail=" + excel_Holding_Table.Rows[i]["EmailAddress"].ToString() + "))";
dSearcher.PageSize = 1000;
sResults = dSearcher.FindAll();

推荐答案

您可以使用 DirectoryEntry 类直接指定用户名和密码:

You can use the DirectoryEntry class directly and specify the username and password:

DirectoryEntry de = new DirectoryEntry(path);

de.Username = "username";
de.Password = "password";

并从 de 对象访问 Active Directory.或者您可以使用 WindowsIdentity 类并模拟用户:

And access Active Directory from the de object. Or you can use the WindowsIdentity class and and impersonate a User:

WindowsIdentity newId = new WindowsIdentity(safeTokenHandle.DangerousGetHandle());
WindowsImpersonationContext impersonatedUser = newId.Impersonate();

完整代码示例位于:

模拟和目录条目