views:

1220

answers:

3

How can I determine if a user, in say Access, is a member of an Active Directory Security Group?

I'd rather not build a whole authentication system into my little Access DB.

Thanks

A: 

Found this online

Function IsMember(strDomain As String, strGroup _
  As String, strMember As String) As Boolean
  Dim grp As Object
  Dim strPath As String

  strPath = "WinNT://" & strDomain & "/"
  Set grp = GetObject(strPath & strGroup & ",group")
  IsMember = grp.IsMember(strPath & strMember)
End Function

Now, I only need the account name of the current user. Too bad Application.CurrentUser doesn't give me their Domain Account name.

Allain Lalonde
Just a word of warning. This code will return the incorrect results for the users primary group (Usually "Domain Users") because that is stored differently in AD.
JohnFx
No problem. I had been fighting with this problem for a few weeks at the end of December and learned most of this the hard way.I strongly recomend a book for this type of issue: "The .NET Developer's Guide to Directory Services Programming"
JohnFx
+2  A: 

Allain found this online

Function IsMember(strDomain As String, strGroup _
  As String, strMember As String) As Boolean
  Dim grp As Object
  Dim strPath As String

  strPath = "WinNT://" & strDomain & "/"
  Set grp = GetObject(strPath & strGroup & ",group")
  IsMember = grp.IsMember(strPath & strMember)
End Function

You can get the Windows account info by way of the USERDOMAIN and USERNAME environment vars:

Function GetCurrentUser() As String
    GetCurrentUser = Environ("USERNAME")
End Function

Function GetCurrentDomain() As String
    GetCurrentDomain = Environ("USERDOMAIN")
End Function

Putting it all together:

If IsMember(GetCurrentDomain, "AD Group", GetCurrentUser) Then
   DoStuff()
End If
Patrick Cuff
True. It's mostly for displaying different screens to different users. Not so much security as usability.
Allain Lalonde
This answer isn't really AD-related -- it's just plain old NTFS groups. AD has things like Organizational Units that are not a part of NTFS and accessible only via LDAP queries.
David-W-Fenton
A: 

This is awesome code and exactly what I was looking for. Thanks to whoever put this out here!!!

Jim