What are the minimum permissions for connectionUsername when using ActiveDirectoryMembershipProvider

Question

I am writing an ASP.NET application using ActiveDirectoryMembershipProvider, similar to the scenario outlined here: http://channel9.msdn.com/wiki/securitywiki/aspnet2formsauthtoadrolesinadintranet/

As part of this setup, I configured ASP.NET Membership as follows:

  <membership defaultProvider="MyADMembershipProvider">
   <providers>
     <add
        name="MyADMembershipProvider"
        type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, 
              Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
        connectionStringName="ADConnectionString"
        connectionUsername="testdomain\administrator" 
        connectionPassword="password"/>
     </providers>
   </membership>

This works, but in production I would like to use a connectionUsername with minimum permissions to anything else, instead of "Administrator". What are the minimum permissions that should be assigned to this account?

Answer 1

See the note in the "Connecting to Active Directory" section at http://msdn.microsoft.com/en-us/library/ms998360.aspx.