What are the security permissions required to enumerate users on active directory

Question

System Specs:

• Infopath 2007 with c# code-behind
• Webservices
• Active Directory

I need to get the users name (First Name and Last Name) from active directory but the user appears to not have permissions to read the active directory listings.

What permissions do I need to give the user in order for them to search AD

I am using code like this

 SearchResult result;
 using (DirectoryEntry de = new DirectoryEntry("LDAP://DC=contoso,DC=com,DC=au"))
 {
     DirectorySearcher search = new DirectorySearcher(de, (string.Format("(&(objectClass=user)(mailNickname={0}))",this.Application.User.UserName)));
     result = search.FindOne();
 }

I have considered creating a webservice that gets the information required but that seems like overkill but would get around having to make sure every possible user of the form is required to have the correct permissions

EDIT:
The code that I am trying to execute is infopath code behind. The form itself connects to webservices to retrieve some of its data. as such it is under infopath's security model. The form is fully trusted so it should be fine to execute under the current user context.
My fault for not adding the extra detail.

Answer 1

Any user of the AD should have permissions to browse the AD by default.

You probably just need to change your directory entry to point to the user container like so:

new DirectoryEntry("LDAP://CN=users,DC=contoso,DC=com,DC=au")

Your user container could be another name.

If that does not solve the problem it may be that the application is not actually running as the user. For example, an ASP.NET website would need to be using impersonation in order to query the AD.

Answer 2

When you create a new DirectoryEntry without specifying a username and password you're connecting to Active Directory using the credentials of the executing user - in your case probably the local IUSR_...-account on the web server which is the default account used when a new web site is set up in IIS. Because that's a local account you won't be able to access Active Directory.

You have two options:

• Create a service account in Active Directory and use that account explicitly, ie DirectoryEntry de = new DirectoryEntry("LDAP://DC=contoso,DC=com,DC=au", "sa-username", "sa-password", AuthenticationTypes.Secure). Of course, passwords in clear text in the code is not a good idea so find a way to encrypt the password.

or

• Configure the IIS application pool for your web site (IIS 6+) to run under a domain user account - that way that account is used when connecting to Active Directory.