Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Create Active Directory user in .NET (C#)

Tags:

I need to create a new user in Active Directory. I have found several examples like the following:

using System;
using System.DirectoryServices;

namespace test {
   class Program {
      static void Main(string[] args) {
        try {
            string path = "LDAP://OU=x,DC=y,DC=com";
            string username = "johndoe";

            using (DirectoryEntry ou = new DirectoryEntry(path)) {
               DirectoryEntry user = ou.Children.Add("CN=" + username, "user");

               user.Properties["sAMAccountName"].Add(username);

               ou.CommitChanges();
            }
         } 
         catch (Exception exc) {
             Console.WriteLine(exc.Message);
         }
      }
   }
}

When I run this code I get no errors, but no new user is created.

The account I'm running the test with has sufficient privileges to create a user in the target Organizational Unit.

Am I missing something (possibly some required attribute of the user object)?

Any ideas why the code does not give exceptions?

EDIT
The following worked for me:

int NORMAL_ACCOUNT = 0x200;
int PWD_NOTREQD = 0x20;
DirectoryEntry user = ou.Children.Add("CN=" + username, "user");
user.Properties["sAMAccountName"].Value = username;
user.Properties["userAccountControl"].Value = NORMAL_ACCOUNT | PWD_NOTREQD;
user.CommitChanges();

So there were actually a couple of problems:

  1. CommitChanges must be called on user (thanks Rob)
  2. The password policy was preventing the user to be created (thanks Marc)
like image 515
Paolo Tedesco Avatar asked Aug 19 '09 08:08

Paolo Tedesco


People also ask

What is Active Directory in C#?

Active Directory with C# is first and foremost to organize computers, company users, and so on. The essential thing is a user management system which is generally used by enterprise networks and for business purposes.

What is DirectorySearcher in c# net?

Use a DirectorySearcher object to search and perform queries against an Active Directory Domain Services hierarchy using Lightweight Directory Access Protocol (LDAP). LDAP is the only system-supplied Active Directory Service Interfaces (ADSI) provider that supports directory searching.

What is LDAP authentication in C#?

LDAP. We have an web application developed using c#(VS 2008/3.5 framework). The application uses the mode of authentication as "Windows" with a service account present in domain (Domain1) to run the application as ASP.Net user. We have authentication to be done for the users present in different domain (Domain 2).


1 Answers

I think you are calling CommitChanges on the wrong DirectoryEntry. In the MSDN documentation (http://msdn.microsoft.com/en-us/library/system.directoryservices.directoryentries.add.aspx) it states the following (emphasis added by me)

You must call the CommitChanges method on the new entry to make the creation permanent. When you call this method, you can then set mandatory property values on the new entry. The providers each have different requirements for properties that need to be set before a call to the CommitChanges method is made. If those requirements are not met, the provider might throw an exception. Check with your provider to determine which properties must be set before committing changes.

So if you change your code to user.CommitChanges() it should work, if you need to set more properties than just the account name then you should get an exception.

Since you're currently calling CommitChanges() on the OU which hasn't been altered there will be no exceptions.

like image 192
RobV Avatar answered Oct 20 '22 13:10

RobV