NTLM/Windows Authentication and GetAllUsers()

Question

I'm designing a web app which will be used on an intranet so Windows authentication mode is ideal. However, part of the app would need the ability to get a list of users (to pick users for assignments. Membership.GetAllUsers() doesn't apply (on its own) with windows-authentication. I can't use ActiveDirectoryMembershipProvider because I won't be allowed to store credentials to bind with; so any AD access would have to be done as the authenticated user.

I've searched off and on for weeks for a clear cut example or solution to this, and I'm beginning to think that nobody in the world has this same problem.

Is my only option to use Application_AuthenticateRequest and connect the two worlds of "membership" to "windows auth"? But then how do I get a list of "all" users elsewhere in the app? Is there an ActiveDirectoryMembershipProvider which impersonates as the calling user?

Answer 1

AD can contain a very large number of users - so in the general case it's not usually practical to list all users.

If you're designing a UI to pick users (e.g. for assignment to roles) I'd do something similar to the existing Windows UI's to select an AD User or Group. For example, enter a few characters and search for matches by first name, last name or common name. Display all matches (up to some maximum - say 1000) and let the user pick from these.