FindByIdentity failing with PricipalOperationException in ASP.NET webapp

Answer 1

Sounds like a double-hop issue - your user connects to the asp.net site, and then the asp.net worker process tries to connect to the Active Directory on its behalf, and fails, since the ASP.NET worker process probably doesn't have enough permissions to query AD.

You'll need to provide some extra credentials when you create the principal context, using some defined user with a password and sufficient credentials to query AD.

You do not have this issues of course in your console app - it runs under your own user account which has plenty of privileges, for sure :-)

If you're serious about Active Directory Programming in C# or VB.NET, go buy this book:

The .NET Developer's Guide to Directory Services Programming

Joe and Ryan have plenty of stuff on using AD from ASP.NET apps and how to deal with that. Also, check out their book-accompanying website forums.

Answer 2

An old question, but I had this same error. For me, the problem is that PrincipalContext doesn't work without a username and password in its constructor... I get the exact same error message whenever I call any method or property of the UserPrincipal (or on the PrincipalContext for that matter).

If you specify a username and password of a domain user with Active Directory permissions to the container you're specifying, the call to FindByIdentity should succeed:

var context = new PrincipalContext(ContextType.Domain, "DOMAINSERVER",
                                   "DC=DOMAINNAME,DC=net", userName, pw); 
var userPrincipal = UserPrincipal.FindByIdentity(context, strWindowsID); 

For me, this isn't a solution, because I won't have those two parameters. But that's why you're getting the error you're getting.

According to Microsoft's help, doing it your way should run under the credentials of the calling process... but no matter who I'm running under (and I've verified the impersonation) calls to a UserPrincipal object without specifying a username and pw on its PrincipalContext just won't work.

Hope that belatedly helps, James