Get status of username from active directory in SharePoint 2010

Question

Hello we are using SharePoint 2010.

Need reference articles for following requirement: There is textbox and button on a webpart. User can enter the domain\username in textbox and click on button. On click, the status of username from textbox must be fetched from AD and displayed.

For example: whether the username is locked, active, whether password has expired, date of expiry of password, etc.

What do you think is good choice:-

1. Fetching the AD data into a list using LDAP and then querying this list on button click? (what permission do I need for this?)

2. Onclick of button use LDAP to fetch data for the username entered in textbox from AD? (not sure of permissions needed for this, any idea?)

3. Use user profile sync service?

4. Use user profile service application?

The above options are a guess, not sure how to go ahead, any guidance will help.. Please note that we do not want to purchase/reuse solutions from codeplex/others, instead we need to create this from scratch for various reasons.

Answer 1

Just fetch the data from Active Directory on the button click and display it. There's no special permissions needed to query AD like this so anyone can do it. Fetching it into a list isn't needed (unless you want to store it, but that's up to you). The user profile sync service/application doesn't provide some LDAP entries like password expiration. While you can map them if you wanted to, you really don't need it (unless you want it to show up on the users My Site pages).

It's easy to query AD using .NET 3.5 (and higher). Here's some code you can use.

First we'll create a class to hold the data we want to display. This makes it easier to read and we don't have to worry about AD property names in our webpart code.

public class UserDetails 
{
    public bool IsAccountLocked { get; set; }
    public bool IsAccountActive { get; set; }
    public bool HasPasswordExpired { get; set; }
    public DateTime PasswordExpirationDate { get; set; }
}

Next we'll build a function that returns us a UserDetails object populated with values fetched from AD.

private static UserDetails GetUserDetailsFor(string username)
{
    var details = new UserDetails();

    try
    {
        // set up domain context
        var ctx = new PrincipalContext(ContextType.Domain);

        // find the user
        var user = UserPrincipal.FindByIdentity(ctx, username);

        if (user != null)
        {
            // get the underlying DirectoryEntry object from the UserPrincipal
            var de = (DirectoryEntry)user.GetUnderlyingObject();

            // now get the UserEntry object from the directory entry
            var ue = (IADsUser)de.NativeObject;

            // locked
            details.IsAccountLocked = ue.IsAccountLocked;

            // active
            details.IsAccountActive = true;

            // whether password expired
            details.HasPasswordExpired = ue.PasswordExpirationDate <= DateTime.Now;

            // date of expiry of password
            details.PasswordExpirationDate = ue.PasswordExpirationDate;

            // explore UserPrinciple class, DirectoryEntry, and IADsUser for more properties you can query 
        }
        else
        {
            details.IsAccountActive = false;
        }

    }
    catch (Exception e)
    {
        // in case something happened when fetching AD properties
        // you can do something here
        details.IsAccountActive = false;
    }

    return details;
}

Finally we'll use the UserDetails object returned from the GetUserDetails function to populate our webpart. You can have it formatted whatever way you want so this is just an example:

private static string BuildHtmlResultFor(string username)
{
    // fetch the user details from Active Directory
    var details = GetUserDetailsFor(username);

    // build up the result you want to show in your webpart
    var sb = new StringBuilder("<ul>");
    sb.AppendFormat("<li>Locked: {0}</li>", details.IsAccountLocked);
    sb.AppendFormat("<li>Active: {0}</li>", details.IsAccountActive);
    sb.AppendFormat("<li>Password Expired: {0}</li>", details.HasPasswordExpired);
    sb.AppendFormat("<li>Date of Password Expiry: {0}</li>", details.PasswordExpirationDate);
    sb.Append("</ul>");

    return sb.ToString();
}

Now all you need to do is pass the value from your TextBox to this method and output the result on the webpart (say to add it to a label or something).

Note, to build this in your webpart you need to add three references to your project:

• System.DirectoryServices (on the .NET tab)
• System.DirectoryServices.AccountManagement (on the .NET tab)
• Active DS Type Library (on the COM tab)

Hope that helps.