views:

101

answers:

1

I want to reuse the Windows authentication to bind to the Active Directory user and check group membership.

I can get the Windows username with Environ("username"), but how do I get the password? I don't want to have to require the user to reenter their password, but there is no Environ("password").

How do I make this code work?

Thanks!

Private Sub ADsAuthenticate()

    Dim objConnection As New ADODB.Connection
    Dim objRecordset As ADODB.Recordset
    Dim objADsUser As IADsUser
    Dim objADsGroup As IADsGroup
    Dim strUsername As String
    Dim strPassword As String

    strUsername = Environ("username")
    strPassword = Environ("password")

    With objConnection
        .Provider = "ADsDSOObject"
        .Properties("User ID") = strUsername
        .Properties("Password") = strPassword
        .Properties("Encrypt Password") = True
        .Open "ADs Provider"
        Set objRecordset = .Execute("<LDAP://<server>/dc=<domain>,dc=com>;" _
        & "(sAMAccountName=" & strUsername & ");ADsPath;Subtree")
    End With

    With objRecordset
        If Not .EOF Then
            Set objADsUser = GetObject("LDAP:").OpenDSObject(.Fields("ADsPath").Value, strUsername, strPassword, ADS_SECURE_AUTHENTICATION)
            Debug.Print objADsUser.ADsPath
            For Each objADsGroup In objADsUser.Groups
                Debug.Print objADsGroup.Name
            Next
        End If
    End With

    objConnection.Close

End Sub
+1  A: 
Joel Coehoorn
I need the password to bind to the user object, so I guess I will have to ask the user for the password again when they launch the application, despite the fact that it is the same password they use to log onto Windows. Thanks for the feedback Joel.
Kuyenda
@Kuy - you should be able to check Active Directory without re-submitting the username and password. One you log into windows, it knows who you are.
Joel Coehoorn
Joel, you were right. objConnection does not require a username and password, but OpenDSObject does. Is there another way to bind to the user object without requiring username and password? Thanks again!
Kuyenda
Got it. OpenDSObject is for when you are outside the domain. In that case, yes, you have to ask for the username and password. If they are inside the domain you can just `Set objADsUser = GetObject(.Fields("ADsPath")`. Thanks again Joel. I'll close this out after I post updated code.
Kuyenda