使用 DirectoryServices 从 C# 连接到 LDAP

Connecting to LDAP from C# using DirectoryServices

提问by Chaitanya

I am trying to connect to an edirectory 8.8 server running LDAP. How would I go about doing that in .Net? Can I still use the classes in System.DirectoryService such as DirectoryEntry and DirectorySearcher or are they AD specific? Do I need to specify the "Connection String" any differently?

我正在尝试连接到运行 LDAP 的 edirectory 8.8 服务器。我将如何在 .Net 中做到这一点？我仍然可以使用 System.DirectoryService 中的类，例如 DirectoryEntry 和 DirectorySearcher 还是它们是 AD 特定的？我需要以不同的方式指定“连接字符串”吗？

I am trying something like the code below but it doesn't seem to work...

我正在尝试类似下面的代码，但它似乎不起作用......

DirectoryEntry de = new DirectoryEntry ("LDAP://novellBox.sample.com","admin","password",AuthenticationTypes.None);
DirectorySearcher ds = new DirectorySearcher(de);
var test = ds.FindAll();

Any ideas?

有任何想法吗？

采纳答案by marc_s

Well, I think your connection string is missing a bit - specifying just the server name isn't good enough - you also need to specify a "starting point" for your search.

好吧，我认为您的连接字符串缺少一点 - 仅指定服务器名称不够好 - 您还需要为搜索指定一个“起点”。

In AD, this would typically be something like the "Users" container in your domain, which you'd specify like this in LDAP parlance:

在 AD 中，这通常类似于您域中的“用户”容器，您可以在 LDAP 用语中这样指定：

LDAP://novellBox.sample.com/cn=Users,dc=YourCompany,dc=com

Not sure how LDAP compliant the newer versions of eDirectory are - but that should work since in theory, it's standard LDAP regardless of the implementation :-)

不确定新版本的 eDirectory 与 LDAP 的兼容性如何 - 但这应该可以工作，因为理论上它是标准的 LDAP，无论实现如何:-)

But then again: only in theory, there's no difference between theory and practice.....

但话又说回来：仅在理论上，理论与实践之间没有区别......

There's also a System.DirectoryServices.Protocolsnamespace which offers low-level LDAP calls directly - and that's definitely not tied to AD at all, but it's really quite low-level.....

还有一个System.DirectoryServices.Protocols直接提供低级 LDAP 调用的命名空间——这绝对与 AD 无关，但它确实是相当低级的.....

There's also a Novell C# LDAP librarybut I've never tried it and can't say how complete or capable it is. It might give you some clues, though!

还有一个Novell C# LDAP 库，但我从未尝试过，也不能说它有多完整或有多强大。不过，它可能会给你一些线索！

Also see this other Stackoverflow questionabout Novell, LDAP and C# - it might give you additional info.

另请参阅有关 Novell、LDAP 和 C# 的其他Stackoverflow 问题- 它可能会为您提供其他信息。

回答by wefwfwefwe

I think you need to use LDAP syntax for the host.

我认为您需要对主机使用 LDAP 语法。

Make sure you don't forget to release the connection with using- if you don't dispose of the directory entries they hang around forever until the pool runs out and your app breaks.

确保您不要忘记释放连接using- 如果您不处理目录条目，它们将永远存在，直到池用完并且您的应用程序中断。

using (DirectoryEntry de = new DirectoryEntry ("LDAP://CN=server,DC=domain,DC=com","admin","password",AuthenticationTypes.Secure))
{
    ...
}

回答by Fermin

I had a hard time figuring this out but you could use something like the following, it worked sweet for me:

我很难弄清楚这一点，但您可以使用以下内容，它对我来说很有效：

Domain domain = Domain.GetDomain(new DirectoryContext(DirectoryContextType.Domain, "novellBox.sample.com");
DirectorySearcher ds = new DirectorySearcher(domain.GetDirectoryEntry(), searchQuery);
using (SearchResultCollection src = ds.FindAll())
{....}

回答by Joshua

I am trying to connect to an edirectory 8.8 server running LDAP. How would I go about doing that in .Net? Can I still use the classes in System.DirectoryService such as DirectoryEntry and DirectorySearcher or are they AD specific?

我正在尝试连接到运行 LDAP 的 edirectory 8.8 服务器。我将如何在 .Net 中做到这一点？我仍然可以使用 System.DirectoryService 中的类，例如 DirectoryEntry 和 DirectorySearcher 还是它们是 AD 特定的？

We are using System.DirectoryServices for Microsoft Active Directory, OpenLDAP running on Linux and eDirectiry without any problem. So the answer is yes, you can use these classes to access eDir.

我们将 System.DirectoryServices 用于 Microsoft Active Directory、Linux 上运行的 OpenLDAP 和 eDirectiry，没有任何问题。所以答案是肯定的，您可以使用这些类来访问 eDir。

Do I need to specify the "Connection String" any differently?

我需要以不同的方式指定“连接字符串”吗？

Yes you are. When passing to DirectoryEntry a string starting with "LDAP://" you need to conform to the LDAP syntax which is very different than URI syntax.

是的，你是。向 DirectoryEntry 传递以“LDAP://”开头的字符串时，您需要符合与 URI 语法非常不同的 LDAP 语法。

I recommend you to use an LDAP browser (google it, there are many free downloads) in order to get the correct path to the root object otherwise you will spend time on trying to figure out the correct object types.

我建议您使用 LDAP 浏览器（google it，有很多免费下载）以获得根对象的正确路径，否则您将花时间试图找出正确的对象类型。

回答by Mike Burr

Depending ont he directory server configuration, you might actually need to use the System.DirectoryServices.Protocols namespace. I wrote up a post on connecting to OpenLDAP with it.

根据目录服务器配置，您可能实际上需要使用 System.DirectoryServices.Protocols 命名空间。我写了一篇关于用它连接到 OpenLDAP 的文章。

http://mikemstech.blogspot.com/2013/03/searching-non-microsoft-ldap.html

http://mikemstech.blogspot.com/2013/03/searching-non-microsoft-ldap.html

回答by Renzo Ciot

If the external LDAP require authentication with DN try this: first retrieve the DN of user, then try the authentication with DN and user credentials. I've tested it on Domino LDAP.

如果外部 LDAP 需要使用 DN 进行身份验证，请尝试以下操作：首先检索用户的 DN，然后尝试使用 DN 和用户凭据进行身份验证。我已经在 Domino LDAP 上对其进行了测试。

// Autheticate in external LDAP
string ldapserver = "10.1.1.1:389";
string ldapbasedn = "o=mycompany";
string ldapuser = "cn=Administrator,o=mycompany";
string ldappassword = "adminpassword";
string ldapfilter = "(&(objectclass=person)(cn={0}))";

string user = "usertest";
string password = "userpassword";
try
{
    string DN = "";
    using (DirectoryEntry entry = new DirectoryEntry("LDAP://" + ldapserver + "/" + ldapbasedn, ldapuser, ldappassword, AuthenticationTypes.None))
    {
        DirectorySearcher ds = new DirectorySearcher(entry);
        ds.SearchScope = SearchScope.Subtree;
        ds.Filter = string.Format(ldapfilter, user);
        SearchResult result = ds.FindOne();
        if (result != null )
        {
            DN = result.Path.Replace("LDAP://" + ldapserver + "/" , "");
        }
    }
    // try logon   
    using (DirectoryEntry entry = new DirectoryEntry("LDAP://" + ldapserver + "/" + ldapbasedn, DN, password, AuthenticationTypes.None))
    {
        DirectorySearcher ds = new DirectorySearcher(entry);
        ds.SearchScope = SearchScope.Subtree;
        SearchResult result = ds.FindOne();
    }
} catch (Exception) { }