need help finding groups for a user from trusted domain

[TravisLaborde]

In our network setup, we have users and groups on one domain and some groups on a separate trusted domain.

I need to find which groups a user is a member of. The "standard 5 lines of code" show me the groups that are on the same domain where the user exists, but not the groups from the trusted domain.

When I run the same query but specify the trusted domain in the CN=... it fails because the user does not exist in that domain.

Can anyone help me with this please?

 

[ThatRickGuy]

How is the user associated with the trusted domain?

-Rick

VB.Net Forum forum796 forum855 ASP.NET Forum
I believe in killer coding ninja monkeys.

 

[TravisLaborde]

The AD guys tell me the two domains have a trust relationship. And that when they manage the second domain, the can simply pull up a group and add members to it from the first domain.

So, we have something like: DOMAINTWO\GroupName

which contains users like: DOMAINONE\UserName


In my code I create a directory searcher with the CN pointing to DOMAINONE and looking up based on the username. I get the memberOf properties and see the groups. But the groups from the second domain are not listed.

If i change the CN to point to DOMAINTWO then the search returns no users.

 

[ThatRickGuy]

Does the user that you are attempting this for in DomainTwo? Does the user account you are logged in as while attempting this have access to DomainTwo?

I would snag a free LDAP browser and see what IS in DomainTwo. Figure out if you need a different user, or account, or to make the link based on groups or something else.

-Rick

VB.Net Forum forum796 forum855 ASP.NET Forum
I believe in killer coding ninja monkeys.

 

[TravisLaborde]

In the second domain, the ussers from the first domain are lised as "ForeignSecurityPrincipals" ...

The "name" is S-1- ... you get the picture... But the "Readable Name" shows as "DOMAIN1\username"

Can I search by "readable name" instead of username and maybe find the user?

Drilling down on that entry does show the groups that I'm interested in.

Thanks!
Travis

 

[ThatRickGuy]

I'm sure there is a way to, but my knowledge of LDAP queries is rather limited. Time to hit up your favorite search engine.

-Rick

VB.Net Forum forum796 forum855 ASP.NET Forum
I believe in killer coding ninja monkeys.