The specified domain either does not exist or could not be contacted.

[Iain]

All,

I am using the following code to query ActiveDirectory :

string pStrUser = this.Context.User.Identity.Name;
using (DirectorySearcher objDS = new
DirectorySearcher("objectCategory=User"))
{
objDS.Filter = "(SAMAccountName=" + pStrUser + ")";
using (DirectoryEntry objUser = new
DirectoryEntry(objDS.FindOne().Path))
{
System.DirectoryServices.PropertyCollection
colProperties = objUser.Properties;
PropertyValueCollection colPropertyValues =
colProperties["memberOf"];
foreach (string strGroup in colPropertyValues)
{
pStrUser += strGroup.ToLower();
}
}
}

This works fine locally but if I attempt to access my page from a
non-local machine i get the following error :

"The specified domain either does not exist or could not be contacted."

I'm assuming this is an IIS configuration issue?

TIA
Iain

[Marc Lognoul [MVP]]

Hello,

I'd see 2 main root causes:
1) The server cannot resolve the name of the domain (try with nslookup
locally on the server to resolve the domain name)
2) Communication between the server and domain controllers is prevented
(lack of IP route, firewall...). Try with tracert mydc.mydomain.local on the
server or using ldp.exe and a simple "connect", both locally on the server.

--
Marc Lognoul [MCSE, MCTS, MVP]
Heureux celui qui a pu p�n�trer les causes secr�tes des choses
Happy is the one who could enter the secret causes of things
Blog EN: http://www.marc-antho-etc.net/blog/
Blog FR: http://www.marc-antho-etc.net/blogfr/

"Iain" <ia...@test.co.uk> wrote in message
news:esQOIujT...@TK2MSFTNGP05.phx.gbl...

[Joe Kaplan]

This normally happens because in IIS, your app pool is running as network
service. Network Service uses the network credentials of the computer
account when performing operations on the network but uses its local
security context for local operations. Because you don't specify anything
to the constructor of the DirectorySearcher to provide a domain hint, under
the hood ADSI will attempt a serverless bind to the directory by getting the
current domain from the security context of the current user.
Unfortunately, the network service account locally has no domain afinity, so
no domain can be inferred. Under Visual Studio with the local test server,
the web server runs as you, not network service, so if you are logged in as
a domain account, a domain can be inferred.

It is easy to fix by providing a DirectoryEntry to the DirectorySearcher
constructor that contains the name of the domain to access:

LDAP://yourdomain.com/DC=yourdomain,DC=com

This should work fine.

Note also that if you are using Windows authentication in your app, you are
wasting time doing an LDAP lookup to get the user's group membership. Just
cast the User.Identity to a WindowsIdentity object and access the Groups
property. You can translate those to friendly names with the Translate
method if you need to. Much easier!

Also, memberOf does not contain nested groups or primary group, so using it
is an incomplete solution to group membership expansion.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net

"Iain" <ia...@test.co.uk> wrote in message
news:esQOIujT...@TK2MSFTNGP05.phx.gbl...

[Iain]

Joe Kaplan wrote:
> This normally happens because in IIS, your app pool is running as
> network service. Network Service uses the network credentials of the
> computer account when performing operations on the network but uses its
> local security context for local operations. Because you don't specify
> anything to the constructor of the DirectorySearcher to provide a domain
> hint, under the hood ADSI will attempt a serverless bind to the
> directory by getting the current domain from the security context of the
> current user. Unfortunately, the network service account locally has no
> domain afinity, so no domain can be inferred. Under Visual Studio with
> the local test server, the web server runs as you, not network service,
> so if you are logged in as a domain account, a domain can be inferred.
>
> It is easy to fix by providing a DirectoryEntry to the DirectorySearcher
> constructor that contains the name of the domain to access:
>
> LDAP://yourdomain.com/DC=yourdomain,DC=com
>
> This should work fine.
>
> Note also that if you are using Windows authentication in your app, you
> are wasting time doing an LDAP lookup to get the user's group
> membership. Just cast the User.Identity to a WindowsIdentity object and
> access the Groups property. You can translate those to friendly names
> with the Translate method if you need to. Much easier!
>
> Also, memberOf does not contain nested groups or primary group, so using
> it is an incomplete solution to group membership expansion.
>

Thanks for the detailed response - unfortunately still getting the same
error when trying to access from non-local machine?

[Iain]

Iain wrote:
> Thanks for the detailed response - unfortunately still getting the same
> error when trying to access from non-local machine?

Just to clarify what requires changing :

string pStrUser = this.Context.User.Identity.Name;
using (DirectorySearcher objDS = new
DirectorySearcher("objectCategory=User"))
{
objDS.Filter = "(SAMAccountName=" + pStrUser + ")";
using (DirectoryEntry objUser = new

DirectoryEntry(objDS.FindOne().Path)) <-----------Into here i need to
pass in the domain name ---------------->

[Joe Kaplan]

You need to build a DirectoryEntry to use in the constructor to your
DirectorySearcher that provides a full path including a domain hint. It may
be easiest to do something like this:

using System.DirectoryServices.ActiveDirectory;

...
Domain d = Domain.GetDomain("yourdomain.com");
DirectoryEntry root = d.GetDirectoryEntry();
using (DirectorySearcher objDS = new DirectorySearcher())
{
objDS.SearchRoot = root;
....

}

Also, like I said you may be wasting your time reading group membership via
LDAP to begin with.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
"Iain" <ia...@test.co.uk> wrote in message

news:OREl5vMU...@TK2MSFTNGP05.phx.gbl...