在 .NET5 中使用 System.DirectoryServices.Protocols 获取 LDAP TokenGroups

Question

由于需要在 linux 上运行，我将一些代码从 System.DirectoryServices 移植到 System.DirectoryServices.Protocols。

大部分代码都很好，但检索tokenGroups 的一小段代码没有出现。

原代码如下：

using (var ldapObject = new DirectoryEntry(objectPath, username, password, AuthenticationTypes.Secure))
        {
            ldapObject.Options.Referral = ReferralChasingOption.All;
            ldapObject.RefreshCache(new string[] { "tokenGroups" });
            foreach (byte[] sid in ldapObject.Properties["tokenGroups"])
            {
                // Won't run on linux
                var groupSID = new System.Security.Principal.SecurityIdentifier(sid, 0).ToString();
                try
                {
                    var group = this.GetSecurityGroupBySID(groupSID);
                }
                catch (Exception ex)
                {
                    log.Warn($"Failed to get group with SID {groupSID}", ex);
                }
            }
        }

objectPath 的格式为 $"LDAP://{domainName}/{distinguishedName}"

我的尝试如下所示：

public void GetExpandedGroups(string objectMail, LdapConnection ldapConnection)
        {
            var usersPath = "OU=active,OU=users,DC=path,DC=etc"; //Not real values
            var filter = $"(&(objectClass = user)(!userAccountControl:1.2.840.113556.1.4.803:= 2)(mail={objectMail}))";
            var request = new SearchRequest(usersPath, filter, SearchScope.Subtree, new string[] { "tokenGroups" });
            request.Controls.Add(new SecurityDescriptorFlagControl(SecurityMasks.Dacl | SecurityMasks.Group | SecurityMasks.Owner));

            var ldapObject = (SearchResponse)ldapConnection.SendRequest(request); // Error thrown here

            foreach (byte[] sid in ldapObject.Entries[0].Attributes["tokenGroups"])
            {
                // Do stuff...
            }
        }

每当它运行时，我都会得到一个错误，抛出。堆栈跟踪和错误响应如下：

   at System.DirectoryServices.Protocols.LdapConnection.<ConstructResponseAsync>d__57.MoveNext()
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Runtime.CompilerServices.ValueTaskAwaiter`1.GetResult()
   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout)
   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request)
   at LDAPTesting.Connectors.Protocols.GetExpandedGroups(String objectMail, LdapConnection ldapConnection) in C:\code\LDAPTesting\LDAPTesting\Connectors\Protocols.cs:line 62
   at LDAPTesting.Connectors.Protocols.GetGroups() in C:\code\LDAPTesting\LDAPTesting\Connectors\Protocols.cs:line 103
   at LDAPTesting.Program.Main(String[] args) in C:\code\LDAPTesting\LDAPTesting\Program.cs:line 17

00002120: SvcErr: DSID-031404CC, problem 5012 (DIR_ERROR), data 0

我的想法是我查询了错误的路径，但它看起来与原始代码请求的路径相匹配，所以我不确定我还缺少什么。

Answer 1

对于遇到此问题的任何人来说，解决方案都非常简单。

SearchRequest 对象必须属于范围 Base。阅读错误信息时真的很明显。所以这行：

var request = new SearchRequest(usersPath, filter, SearchScope.Subtree, new string[] { "tokenGroups" });

应该改为：

var request = new SearchRequest(usersPath, filter, SearchScope.Base, new string[] { "tokenGroups" });

我有一种感觉，因为忽略了一些东西，所以会有一个明显而简单的答案，确实有！

Answer 2

我想我找到了解决方案 - 它只是第一个值不正确 - 如果忽略它，一切正常！