Suppose User X logs into SharePoint and there is webpart to access and change his AD properties, I want to know:
what permission should be there for him to be able to query his AD properties.
what permissions should be there to modify his AD properties.?
In an application page OR a webpart, under which account credentials does the .NET code run? Is it the current user or is it the application pool account? The reason I am asking this is that accordingly either all SP users or apppoolaccount needs to be given permissions (if applicable) to access/modify AD properties.
Is LDAP the only way to access/modify AD via .NET code?
Please note that the access/modify is to be done programatically via code and not using user profile app or sync.