Why might UserPrincipal.GetAuthorizationGroups() fail for one principal but not another?

Question

I am running the following code in an ASP.Net MVC website:

  using (var ctx = new PrincipalContext(ContextType.Domain, DOMAIN))
  using (var userPrincipal = UserPrincipal.FindByIdentity(ctx, principal.Identity.Name))
  using (var groups = userPrincipal.GetAuthorizationGroups())

The code is used a custom RoleProvider and the variable "principal" is HttpContext.Current.User. DOMAIN is my local domain.

This code works fine when I log in to the site, but throws an exception on the last line if I log in as either of a couple of test users.

While trying to retrieve the authorization groups, an error (5) occurred.

The test users have fewer permissions on the domain but are users in active directory. I tried creating the PrincipalContext with an alternative constructor supplying my username and password but it didn't make any difference to the behaviour.

This happens both on my dev machine and also on a separate staging server so I don't think it has anything to do with local permissions. I also don't see how it can be related to the users' permissions as I would expect the active directory request to be made as the IIS App Pool user (impersonation is turned off) or perhaps the user specified in the PrincipalContext constructor.

Any suggestions as to what is going on gratefully received.

Answer 1

It's not enough that they are users in Active Directory. The IIS App Pool user needs to be a member of the Windows Authorization Access Group to execute GetAuthorizationGroups.

Answered here: While trying to retrieve the authorization groups, an error (5) occurred