See if user is part of Active Directory group in C# + Asp.net

Question

I need a way to see if a user is part of an active directory group from my .Net 3.5 asp.net c# application.

I am using the standard ldap authentication example off of msdn but I don't really see how to check against a group.

Answer 1

With 3.5 and System.DirectoryServices.AccountManagement this is a bit cleaner:

public List<string> GetGroupNames(string userName) {   var pc = new PrincipalContext(ContextType.Domain);   var src = UserPrincipal.FindByIdentity(pc, userName).GetGroups(pc);   var result = new List<string>();   src.ToList().ForEach(sr => result.Add(sr.SamAccountName));   return result; } 

Answer 2

Nick Craver's solution doesn't work for me in .NET 4.0. I get an error about an unloaded AppDomain. Instead of using that, I used this (we only have one domain). This will check groups of groups as well as direct group membership.

using System.DirectoryServices.AccountManagement; using System.Linq;  ...  using (var ctx = new PrincipalContext(ContextType.Domain, yourDomain)) {     using (var grp = GroupPrincipal.FindByIdentity(ctx, IdentityType.Name, yourGroup)) {         bool isInRole = grp != null &&              grp             .GetMembers(true)             .Any(m => m.SamAccountName == me.Identity.Name.Replace(yourDomain + "\\", ""));     } }