Groups | Blog | Home
all groups > dotnet security > may 2006 >

dotnet security : How to get user id guid


Keith Harris
5/18/2006 12:06:02 PM
Hi

I am developing a SSO web part between a SharePoint site and my web
application. I would like to accomplish this by passing the guid of the
currently logged on user to the target web site.

It seems the only way to get this id is by performing an AD lookup for the
current logged in user. Is that correct or am I missing something?

Because of the difficulty in setting up DirectoryServices access from an SPS
web part, I would like to discover an easier way of doing this.

Any help is greatly appreciated.
Joe Kaplan (MVP - ADSI)
5/18/2006 2:36:35 PM
You might consider p/invoking the TranslateName API or something like that.

Agreed that if you want to use the authenticated user's credentials to
access AD via LDAP, you will need Kerberos delegation and that can be a
little painful at times. It is definitely possible though.

Joe K.

[quoted text, click to view]

Keith Harris
5/18/2006 3:07:01 PM
Thanks for your reply Joe.
I'm having some trouble figuring out the methods of the secur32 dll. Do you
know of any resources that could help figure out how I can get the guid for
the current logged on user?

Thank You.

[quoted text, click to view]
Keith Harris
5/18/2006 4:20:02 PM
Hi Joe,
I found the information I needed to use the secur32 dll but when I try to
convert the username to a unique id, it's always blank. Here's the code I
use:

///////////////////////////////////////////////////////////////////////////////
#region setup call to dll
[Flags]
public enum EXTENDED_NAME_FORMAT
{
NameUnknown = 0,
NameFullyQualifiedDN = 1,
NameSamCompatible = 2,
NameDisplay = 3,
NameUniqueId = 6,
NameCanonical = 7,
NameUserPrincipal = 8,
NameCanonicalEx = 9,
NameServicePrincipal = 10,
NameDnsDomain = 12
}
///////////////////////////////////////////////////////////////////////////////
[DllImport("secur32", CharSet=CharSet.Auto, SetLastError=true)]
static extern bool TranslateName(string lpAccountName,
EXTENDED_NAME_FORMAT AccountNameFormat, EXTENDED_NAME_FORMAT
DesiredNameFormat, System.Text.StringBuilder lpTranslatedName, ref int nSize);
#endregion

///////////////////////////////////////////////////////////////////////////////
string PrintName(string userName, EXTENDED_NAME_FORMAT fromFmt)
{
StringBuilder translatedName = new StringBuilder(256);
int nSize = translatedName.Capacity;
if (!TranslateName(userName, fromFmt,
EXTENDED_NAME_FORMAT.NameUniqueId, translatedName, ref nSize))
return Marshal.GetLastWin32Error().ToString();
else
return translatedName.ToString();
}

///////////////////////////////////////////////////////////////////////////////
protected void Page_Load(object sender, EventArgs e)
{
string username = HttpContext.Current.User.Identity.Name;
Response.Write(PrintName(username,
EXTENDED_NAME_FORMAT.NameDnsDomain));
}

///////////////////////////////////////////////////////////////////////////////

My web site is using Integrated Windows authentication with Digest
authentication selectec and Anonymous access off.

I appreciate any ideas you might have.

Thanks for you help,
-Keith

[quoted text, click to view]
Joe Kaplan (MVP - ADSI)
5/19/2006 9:43:57 AM
Your p/invoke looks good to me. I think I'd change it throw a
System.ComponentModel.Win32Exception using the result from GetLastWin32Error
if there is a failure, but I don't think that is crucial.

You might try www.pinvoke.net to see if they've wrapped this API or also
perhaps try the framework.interop newgroup. If I get a chance to play with
later today, I'll try it myself and see what can be made to happen.

Joe K.

[quoted text, click to view]

Keith Harris
5/19/2006 3:55:01 PM
I found a much easier way to get the user id is to use the UserProfileManager
to get a UserProfile object which contains the user's id. Here's the code:

UserProfileManager upm = new UserProfileManager(PortalContext.Current);
if (upm != null)
{
UserProfile up = upm.GetUserProfile(HttpContext.Current.User.Identity.Name);
if (up != null)
return up.ID;
}


[quoted text, click to view]
Joe Kaplan (MVP - ADSI)
5/19/2006 11:00:56 PM
Great, if that works, then cool. Is that a SharePoint feature, or something
else?

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
[quoted text, click to view]

Keith Harris
5/20/2006 4:32:01 PM
SharePoint. These are classes in the
Microsoft.SharePoint.Portal.UserProfiles namespace.

[quoted text, click to view]
AddThis Social Bookmark Button