c# - 优化AD搜索-获取群成员

Question

是否可以只查询组中的那些成员，这也是来自AD的组？

现在我正在使用以下代码:

var group = GroupPrincipal.FindByIdentity(ctx, identityType, domainGroup);
if (null != group)
{
    var subGroups = group.GetMembers().Where(g => g is GroupPrincipal).Select(g => g.Name);
................
}

问题是我的组有大量用户(超过 50 000)，因此查询工作时间非常长。此外，传输大量数据。

如何在单个请求中只查询直接子组(而不是用户)？

编辑

我最终得到了 DirectorySearcher。这是我完成的代码:

using (var searcher = new DirectorySearcher(string.Format("(&(objectCategory=group)(objectClass=group)(memberof={0}))", group.DistinguishedName), new[] { "cn" }))
{
    searcher.PageSize = 10000;
    var results = SafeFindAll(searcher);

    foreach (SearchResult result in results)
    {
        for (int i = 0; i < result.Properties["cn"].Count; i++)
        {
            subGroups.Add((string)result.Properties["cn"][i]);
        }
    }
}

Answer 1

我会建议使用较低级别的 DirectoryServices.Protocols 命名空间而不是 DirectoryServices.AccountManagement 来做这样的事情。

AccountManagement 库中我(以及许多其他人)遇到的问题是缺乏自定义和配置。也就是说，这就是我在 Active Directory 中搜索的方式，同时也使用了 System.DirectoryServices.Protocols.SearchScope。

//Define the connection
var ldapidentifier = new LdapDirectoryIdentifier(ServerName, port);
var ldapconn = new LdapConnection(ldapidentifier, credentials);

//Set some session options (important if the server has a self signed cert or is transferring over SSL on Port 636)
ldapconn.SessionOptions.VerifyServerCertificate += delegate { return true; };
ldapconn.SessionOptions.SecureSocketLayer = true;

//Set the auth type, I'm doing this from a config file, you'll probably want either Simple or Negotatie depending on the way your directory is configured.
ldapconn.AuthType = config.LdapAuth.LdapAuthType;

这是 DirectoryServices 真正开始发光的地方。您可以轻松定义过滤器以按特定组或子组进行搜索。你可以这样做:

string ldapFilter = "(&(objectCategory=person)(objectclass=user)(memberOf=CN=All Europe,OU=Global,dc=company,dc=com)";  

//Create the search request with the domain, filter, and SearchScope. You'll most likely want Subtree here, but you could possibly use Base as well. 
var getUserRequest = new SearchRequest(Domain, ldapFilter, SearchScope.Subtree)                                        

//This is crucial in getting the request speed you want. 
//Setting the DomainScope will suppress any refferal creation during the search
var SearchControl = new SearchOptionsControl(SearchOption.DomainScope);
getUserRequest.Controls.Add(SearchControl);

//Now, send the request, and get your array of Entry's back
var Response = (SearchResponse)ldapconn.SendRequest(getUserRequest);

SearchResultEntryCollection Users = Response.Entries;

这可能不是您所需要的，但如您所见，您可以更灵活地更改和修改搜索条件。我使用此代码搜索大量域结构，它几乎是即时的，即使有大量用户和组也是如此。