关于Active Directory的一些操作

最近开发了一个关于Active directory(活动目录)的一个web外壳管理程序，在这里做一下总结。
先推荐一片文章：http://www.codeproject.com/KB/system/everythingInAD.aspx
一、连接AD
file:ADConnection.aspx.cs

连接AD
 1using System;
 2using System.Data;
 3using System.Configuration;
 4using System.Collections;
 5using System.Web;
 6using System.Web.Security;
 7using System.Web.UI;
 8using System.Web.UI.WebControls;
 9using System.Web.UI.WebControls.WebParts;
10using System.Web.UI.HtmlControls;
11using System.DirectoryServices;
12using System.Xml;
13
14public partial class ADConnection_ADConnection : System.Web.UI.Page
15{
16    protected void Page_Load(object sender, EventArgs e)
17    {
18        if (!IsPostBack)
19        {
20            GetDefaultLdappath();
21        }
22    }
23    //Get default ladppath
24    //根据LDAP.xml中的数据使TextBox中载入默认的域名DC=Test,dc=net
25    public void GetDefaultLdappath()
26    {
27        XmlDocument xmlDoc = new XmlDocument();
28        //载入xml文档
29        xmlDoc.Load(Server.MapPath("/LDAP.xml"));
30        //选中root节点
31        XmlNodeList nodeList = xmlDoc.SelectSingleNode("root").ChildNodes;
32        //遍历节点并找出DefaultLdappath
33        foreach (XmlNode xn in nodeList)
34        {
35            if (xn.Name == "resource" && xn.Attributes["name"].Value == "DefaultLdappath")
36            {
37                txtLDAP.Text = xn.InnerText.Trim();
38            }
39        }
40    }
41    protected void ibnConnect_Click(object sender, ImageClickEventArgs e)
42    {
43        try
44        {
45            //Connection
46            string userName = txtUsername.Text;
47            string userPwd = txtPassword.Text;
48            DirectoryEntry ent = new DirectoryEntry("LDAP://" + txtLDAP.Text, userName, userPwd);
49            //lock for object
50            ViewState["isRetruned"] = false;
51            //在AD中查找用户，如果有此用户，且密码正确，则跳转相应页面
52            findCN(ent);
53        }
54        catch (Exception ex)
55        {
56            Response.Write(ex.Message + "<br>" 
57                + "Maybe you have not the power.Please contact the administrator.");
58        }
59    }
60
61    //Look for CN=Person
62    private void findCN(DirectoryEntry ent)
63    {
64        foreach (DirectoryEntry Child in ent.Children)
65        {
66            if (Child.Name.Substring(0, 2) == "OU")
67            {
68                //如果对象是组织单元，则递归查找下一层节点            
69                findCN(Child);
70                //如果已经查找到用户，则返回
71                if (Convert.ToBoolean(ViewState["IsReturned"]))
72                {
73                    return;
74                }
75            }
76            else if (Child.Parent.Name.Substring(0, 2) == "OU"
77                && Child.Properties["sAMAccountName"].Value.ToString().ToLower() == txtUsername.Text.Trim().ToLower())
78            {
79                //Session["IsValid"] = "yes";
80                //用session存储相关数据。
81                Session["Ldappath"] = txtLDAP.Text;
82                //将用户名和密码加密后存储，可逆加密，因为后面还会用到此用户名和密码
83                Session["ADUserName"] =Components.DAL.myData.EncryptDES(txtUsername.Text.Trim(), "FGNCName");
84                Session["ADUserPwd"] = Components.DAL.myData.EncryptDES(txtPassword.Text.Trim(), "FGNCPswd");
85                ViewState["IsReturned"] = true;
86                //如果此页面是某些相关页面是某些特定页面传过来的(需要在连接AD成功后返回到其页面)
87                if (Request.QueryString["pagename"] != null)
88                {
89                    string pagename = Request.QueryString["pagename"];
90                    Response.Redirect(pagename, false);
91                }
92                return;
93            }
94        }
95    }

1  ActiveDs.IADsUser user = (ActiveDs.IADsUser)entry.NativeObject;
2            TSUSEREXLib.IADsTSUserEx m_TsUser;
3            m_TsUser = (TSUSEREXLib.IADsTSUserEx)user;
4            if (txtTProfile.Text != "") m_TsUser.TerminalServicesProfilePath = txtTProfile.Text;
5            if (txtTLocalpath.Text != "") m_TsUser.TerminalServicesHomeDirectory = txtTLocalpath.Text;
这里using System.DirectoryServices;需要手动添加引用Add Reference，然后添加System.DirectoryService.
上面在用Session存储用户名和密码的时候还用到了DES可逆加密的方法，其文件如下：
file：myData.cs

加密
 1using System;
 2using System.Collections.Generic;
 3using System.Text;
 4using System.Security.Cryptography;
 5using System.IO;
 6using System.Xml;
 7namespace Components.DAL
 8{
 9    public class myData
10    {
11
12        //默认密钥向量
13        private static byte[] Keys = { 0x22, 0x56, 0x91, 0xAE, 0x90, 0xAB, 0xCD, 0xEF };
14        /**//// <summary>
15        /// DES加密字符串
16        /// </summary>
17        /// <param name="encryptString">待加密的字符串</param>
18        /// <param name="encryptKey">加密密钥,要求为8位</param>
19        /// <returns>加密成功返回加密后的字符串，失败返回源串</returns>
20        public static string EncryptDES(string encryptString, string encryptKey)
21        {
22            try
23            {
24                byte[] rgbKey = Encoding.UTF8.GetBytes(encryptKey.Substring(0, 8));
25                byte[] rgbIV = Keys;
26                byte[] inputByteArray = Encoding.UTF8.GetBytes(encryptString);
27                DESCryptoServiceProvider dCSP = new DESCryptoServiceProvider();
28                MemoryStream mStream = new MemoryStream();
29                CryptoStream cStream = new CryptoStream(mStream, dCSP.CreateEncryptor(rgbKey, rgbIV), CryptoStreamMode.Write);
30                cStream.Write(inputByteArray, 0, inputByteArray.Length);
31                cStream.FlushFinalBlock();
32                return Convert.ToBase64String(mStream.ToArray());
33            }
34            catch
35            {
36                return encryptString;
37            }
38        }
39
40        /**//// <summary>
41        /// DES解密字符串
42        /// </summary>
43        /// <param name="decryptString">待解密的字符串</param>
44        /// <param name="decryptKey">解密密钥,要求为8位,和加密密钥相同</param>
45        /// <returns>解密成功返回解密后的字符串，失败返源串</returns>
46        public static string DecryptDES(string decryptString, string decryptKey)
47        {
48            try
49            {
50                byte[] rgbKey = Encoding.UTF8.GetBytes(decryptKey);
51                byte[] rgbIV = Keys;
52                byte[] inputByteArray = Convert.FromBase64String(decryptString);
53                DESCryptoServiceProvider DCSP = new DESCryptoServiceProvider();
54                MemoryStream mStream = new MemoryStream();
55                CryptoStream cStream = new CryptoStream(mStream, DCSP.CreateDecryptor(rgbKey, rgbIV), CryptoStreamMode.Write);
56                cStream.Write(inputByteArray, 0, inputByteArray.Length);
57                cStream.FlushFinalBlock();
58                return Encoding.UTF8.GetString(mStream.ToArray());
59            }
60            catch
61            {
62                return decryptString;
63            }
64        }
65        public static string GetXmlData(string XmlPath, string name)
66        {
67            XmlDocument xmlDoc = new XmlDocument();
68            xmlDoc.Load(XmlPath);
69            XmlNodeList xnl = xmlDoc.SelectSingleNode("root").ChildNodes;
70            foreach (XmlNode xn in xnl)
71            {
72                if (xn.Name == "resource" && xn.Attributes["name"].Value == name)
73                {
74                    return xn.InnerText;
75                }
76            }
77            return "somethingwrong";
78        }
79    }
80}

1  ActiveDs.IADsUser user = (ActiveDs.IADsUser)entry.NativeObject;
2            TSUSEREXLib.IADsTSUserEx m_TsUser;
3            m_TsUser = (TSUSEREXLib.IADsTSUserEx)user;
4            if (txtTProfile.Text != "") m_TsUser.TerminalServicesProfilePath = txtTProfile.Text;
5            if (txtTLocalpath.Text != "") m_TsUser.TerminalServicesHomeDirectory = txtTLocalpath.Text; 二、读取AD中CN=person的属性
(1)、使用properties属性

Properties
1  ActiveDs.IADsUser user = (ActiveDs.IADsUser)entry.NativeObject;
2            TSUSEREXLib.IADsTSUserEx m_TsUser;
3            m_TsUser = (TSUSEREXLib.IADsTSUserEx)user;
4            if (txtTProfile.Text != "") m_TsUser.TerminalServicesProfilePath = txtTProfile.Text;
5            if (txtTLocalpath.Text != "") m_TsUser.TerminalServicesHomeDirectory = txtTLocalpath.Text;

(2）、使用IADs接口访问一些properties没有的属性
需先添加引用Active DS Type Library和tsexusrm 1.0 Type Library

IADS
1  ActiveDs.IADsUser user = (ActiveDs.IADsUser)entry.NativeObject;
2            TSUSEREXLib.IADsTSUserEx m_TsUser;
3            m_TsUser = (TSUSEREXLib.IADsTSUserEx)user;
4            if (txtTProfile.Text != "") m_TsUser.TerminalServicesProfilePath = txtTProfile.Text;
5            if (txtTLocalpath.Text != "") m_TsUser.TerminalServicesHomeDirectory = txtTLocalpath.Text;

增加、删除、修改属性与查询类似。
三、细节属性示例
Active Directory Users and Computers中的CN=person用户（注意是用户，而不是计算机）Properties->Account->
Account Options:

Account Options
 1//Account Options
 2        if (Convert.ToBoolean(ds.Tables[0].Rows[0]["IsLastSet"]))
 3        {
 4            chkAccountOptions.Items[0].Selected = true;
 5        }
 6        else
 7        {
 8            chkAccountOptions.Items[0].Selected = false;
 9        }        
10        int UserAccountControl = Convert.ToInt32(ds.Tables[0].Rows[0]["userAccountControl"]);
11        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_PASSWD_CANT_CHANGE)) != 0)
12        { chkAccountOptions.Items[1].Selected = true; }
13        else { chkAccountOptions.Items[1].Selected = false; }
14        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_DONT_EXPIRE_PASSWD)) != 0)
15        { chkAccountOptions.Items[2].Selected = true; }
16        else { chkAccountOptions.Items[2].Selected = false; }
17        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED)) != 0)
18        { chkAccountOptions.Items[3].Selected = true; }
19        else { chkAccountOptions.Items[3].Selected = false; }
20        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_ACCOUNTDISABLE)) != 0)
21        { chkAccountOptions.Items[4].Selected = true; }
22        else { chkAccountOptions.Items[4].Selected = false; }
23        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_SMARTCARD_REQUIRED)) != 0)
24        { chkAccountOptions.Items[5].Selected = true; }
25        else { chkAccountOptions.Items[5].Selected = false; }
26        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_NOT_DELEGATED)) != 0)
27        { chkAccountOptions.Items[6].Selected = true; }
28        else { chkAccountOptions.Items[6].Selected = false; }
29        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_USE_DES_KEY_ONLY)) != 0)
30        { chkAccountOptions.Items[7].Selected = true; }
31        else { chkAccountOptions.Items[7].Selected = false; }
32        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_DONT_REQUIRE_PREAUTH)) != 0)
33        { chkAccountOptions.Items[8].Selected = true; }
34        else { chkAccountOptions.Items[8].Selected = false; }

 1//Account Options
 2        if (Convert.ToBoolean(ds.Tables[0].Rows[0]["IsLastSet"]))
 3        {
 4            chkAccountOptions.Items[0].Selected = true;
 5        }
 6        else
 7        {
 8            chkAccountOptions.Items[0].Selected = false;
 9        }        
10        int UserAccountControl = Convert.ToInt32(ds.Tables[0].Rows[0]["userAccountControl"]);
11        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_PASSWD_CANT_CHANGE)) != 0)
12        { chkAccountOptions.Items[1].Selected = true; }
13        else { chkAccountOptions.Items[1].Selected = false; }
14        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_DONT_EXPIRE_PASSWD)) != 0)
15        { chkAccountOptions.Items[2].Selected = true; }
16        else { chkAccountOptions.Items[2].Selected = false; }
17        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED)) != 0)
18        { chkAccountOptions.Items[3].Selected = true; }
19        else { chkAccountOptions.Items[3].Selected = false; }
20        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_ACCOUNTDISABLE)) != 0)
21        { chkAccountOptions.Items[4].Selected = true; }
22        else { chkAccountOptions.Items[4].Selected = false; }
23        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_SMARTCARD_REQUIRED)) != 0)
24        { chkAccountOptions.Items[5].Selected = true; }
25        else { chkAccountOptions.Items[5].Selected = false; }
26        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_NOT_DELEGATED)) != 0)
27        { chkAccountOptions.Items[6].Selected = true; }
28        else { chkAccountOptions.Items[6].Selected = false; }
29        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_USE_DES_KEY_ONLY)) != 0)
30        { chkAccountOptions.Items[7].Selected = true; }
31        else { chkAccountOptions.Items[7].Selected = false; }
32        if ((UserAccountControl & Convert.ToInt32(ActiveDs.ADS_USER_FLAG.ADS_UF_DONT_REQUIRE_PREAUTH)) != 0)
33        { chkAccountOptions.Items[8].Selected = true; }
34        else { chkAccountOptions.Items[8].Selected = false; }上面只是列出了读的方法，写与读很类似，但有些却与读大相径庭，因为有些属性是只读的，你不能给它们直接赋值来改变它们的属性，需要通过其他方法来实现。遇到不懂的最好还是多查查MSDN，既权威又详细。