c# - 错误 : "An operations error occurred" in System. DirectoryServices.AccountManagement.UserPrincipal.FindByIdentity

Question

我有以下代码来检索我的 MVC3 网络应用程序中给定用户名的 AD 组:

PrincipalContext userDomain = new PrincipalContext(ContextType.Domain, username.Split('\\')[0]);
UserPrincipal user = UserPrincipal.FindByIdentity(userDomain, username);
PrincipalSearchResult<Principal> memberOfGroups = user.GetGroups();
IEnumerator<Principal> memberOfGroupsEnumerator = memberOfGroups.GetEnumerator();
List<string> userADGroups = new List<string>();

try
{
    while (memberOfGroupsEnumerator.MoveNext())
    {
        userADGroups.Add(memberOfGroupsEnumerator.Current.ToString());
    }
}
catch
{
    // When trying to access AD groups of a different domain, issues can arise at the end of the enumerator. These may be ignored.

}

这在本地工作正常，但是当部署到网络上的另一台机器上时会出现以下错误:

An operations error occurred.

错误的堆栈跟踪:

System.DirectoryServices.DirectoryServicesCOMException (0x80072020): An operations error occurred.
at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_AdsObject()
at System.DirectoryServices.PropertyValueCollection.PopulateList()
at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)
at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)
at System.DirectoryServices.AccountManagement.PrincipalContext.DoLDAPDirectoryInitNoContainer()
at System.DirectoryServices.AccountManagement.PrincipalContext.DoDomainInit()
at System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()
at System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()
at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithTypeHelper(PrincipalContext context, Type principalType, Nullable`1 identityType, String identityValue, DateTime refDate)
at System.DirectoryServices.AccountManagement.UserPrincipal.FindByIdentity(PrincipalContext context, String identityValue)
at MvcSFIWebSite.Models.User..ctor(String username)

错误消息相当含糊，我无法弄清楚发生了什么，因为它在本地运行良好。

用于部署的机器上的 IIS 使用自定义帐户而不是 AppPool 身份。是否应授予此帐户访问 AD 组目录的任何权限？ IIS 中是否明确需要任何其他设置才能使其正常工作？

任何建议都会很有帮助。提前致谢。

Answer 1

问题是因为 identity_impersonate 在 web.config 中设置为 true，因此传递的用户 token 是辅助 token ，因此无法访问 Active Directory。

This answer解决了我的问题。