SharePoint 2010: Linking SharePoint User to Active Directory User

While we are using SharePoint Foundation, Sometimes we need to get the active directory user details based on current logged in user. If you are using SharePoint Server then this is not a big deal as you can get the user details through user profile. However, if you are using SharePoint Foundation then there’s no shortcut way to getting user details. However, one of my client is using SharePoint Foundation and wanted to get the user details from active directory (say user’s First Name). Here’s how I’ve achieved this:

 

Step 1: Created a timer job to import user details from Active Directory

I have created a custom list to store imported data from Active Directory into SharePoint. The list looks like below

Figure 1: SharePoint List to keep Active Directory User Details

 

As shown in the figure 1, the SID is the key to map a SharePoint user to Active Directory User. The following code snippet shows the code to import data

First I created DTO class to represent LDAP User:

public class LdapUser
{
    public int ID { get; set; }
    public bool IsActive { get; set; }
    public string FirstName { get; set; }
    public string LastName { get; set; }
    public string Email { get; set; }
    public string SId { get; set; }
    public string DisplayName { get; set; }
    public string UserName { get; set; }
}

Figure 2: An DTO to keep Active directory and/or SharePoint list data

 

The following code is to get the Active Directory data into LdapUser DTO:

public IList<LdapUser> GetUsersFromActiveDirectory(string connectionString, string userName, string password)
{
    var users = new List<LdapUser>();

    const int UF_ACCOUNTDISABLE = 0x0002;


    using (var directoryEntry = new DirectoryEntry(connectionString, userName, password, AuthenticationTypes.None))
    {
        var directorySearcher = new DirectorySearcher(directoryEntry);
        directorySearcher.Filter =
            "(&(objectClass=user)(objectClass=person)(objectClass=organizationalPerson)(!objectClass=computer))";
        var propertiesToLoad = new[] 
        { 
            "SAMAccountName", 
            "displayName", 
            "givenName", 
            "sn", 
            "mail", 
            "userAccountControl", 
            "objectSid" 
        };
        directorySearcher.PropertiesToLoad.AddRange(propertiesToLoad);

        foreach (SearchResult searchEntry in directorySearcher.FindAll())
        {
            var userEntry = searchEntry.GetDirectoryEntry();
            var ldapUser = new LdapUser();
            ldapUser.DisplayName = NullHandler.GetString(userEntry.Properties["displayName"].Value);
            if (string.IsNullOrEmpty(ldapUser.DisplayName))
                continue;
            ldapUser.Email = NullHandler.GetString(userEntry.Properties["mail"].Value);
            ldapUser.FirstName = NullHandler.GetString(userEntry.Properties["givenName"].Value);
            ldapUser.LastName = NullHandler.GetString(userEntry.Properties["sn"].Value);
            ldapUser.UserName = NullHandler.GetString(userEntry.Properties["SAMAccountName"].Value);
            var userAccountControl = (int)userEntry.Properties["userAccountControl"].Value;
            ldapUser.IsActive = (userAccountControl & UF_ACCOUNTDISABLE) != UF_ACCOUNTDISABLE;
            var sid = new SecurityIdentifier((byte[])userEntry.Properties["objectSid"][0], 0).Value;
            ldapUser.SId = sid;
            users.Add(ldapUser);
        }
    }
    return users;
}

Figure 2: A method to get Active Directory User data in DTO format

 

I’ve used a helper class NullHandler above, which is shown below:

public class NullHandler
{
    public static string GetString(object value)
    {
        return (value == null || value == DBNull.Value) ? string.Empty : value.ToString();
    }
}

 

The above method GetUsersFromActiveDirectory return the Ldap dto from Active Directory. Then you need to save the Ldap dto into SharePoint. The following code shown the method that will save the Ldap dto in SharePoint list:

public void SaveActiveDirectoryUsersToSharePointList(SPWeb currentWeb, IList<LdapUser> ldapUsers)
{
    const string query = @"<Where><Eq><FieldRef Name='SID'/><Value Type='Text'>{0}</Value></Eq></Where>";
    var ldapUserList = currentWeb.Lists["LDAPUsers"];
    foreach (var ldapUser in ldapUsers)
    {
        SPQuery spQuery = new SPQuery();
        spQuery.Query =  string.Format(query, ldapUser.SId);
        var items = ldapUserList.GetItems(spQuery);

        SPListItem listItem;

        //if the user exists with the same Sid then update 
        //either create a new list item.
        if (items.Count == 1)
        {
            listItem = items[0];
        }
        else
        {
            listItem = ldapUserList.AddItem();
        }
        listItem[Constants.Lists.LdapUsersList.Email] = ldapUser.Email;
        listItem[Constants.Lists.LdapUsersList.FirstName] = ldapUser.FirstName;
        listItem[Constants.Lists.LdapUsersList.LastName] = ldapUser.LastName;
        listItem[Constants.Lists.LdapUsersList.DisplayName] = ldapUser.DisplayName;
        listItem[Constants.Lists.LdapUsersList.IsActive] = ldapUser.IsActive;
        listItem[Constants.Lists.LdapUsersList.PID] = ldapUser.SId;
        listItem[Constants.Lists.LdapUsersList.UserName] = ldapUser.UserName;
        listItem.Update();
    }
}

Figure 3: A method to save DTO (LdapUser) in SharePoint list.

 

In the above method SaveActiveDirectoryUsersToSharePointList, if a listitem with the same SId as in the LdapUsers list, then the list item is updated or a new one is added. So SId is key to synchronize list item and Active Directory item.

 

After User data is imported from Active Directory to SharePoint, the SharePoint list has use details. As shown in the image below, the user doceditor properties in Active Directory is shown on the left side whereas the imported SharePoint list in right side.

Figure 4: Active Directory User and SharePoint list item side-by-side

 

Finally you can create a timer job to sync data from Active Directory to SharePoint list. However, I’m skipping this step for brevity.

Step 2: Retrieve SPUser’s details from SharePoint List where Active Directory data imported

As shown in the code below, you can get current SharePoint user’s SId by accessing SPUser’s Sid property. Once you have the sid you can query the list (LDAPUsers) where you imported the user data from Active Directory.

var ldapList = currentWeb.Lists["LDAPUsers"];
var currentUserSid = currentWeb.CurrentUser.Sid;
var query = new SPQuery();
query.Query = string.Format(@"<Where>
                    <Eq>
                        <FieldRef Name='PID'  />
                        <Value Type='Text'>{0}</Value>
                    </Eq>
                </Where>", sid);
var items = ldapList.GetItems(query);
if (items.Count == 1)
{
    var ldapUserListItem = items[0];
}

Conclusion

So the Active directory sid is mapped to current SPUser’s Sid. So you can access the Active Directory user’s Sid using code shown below:

var sid = new SecurityIdentifier((byte[])userEntry.Properties["objectSid"][0], 0).Value;

Then you can get the SharePoint User’s Sid by using the code snippet below:

SPContext.Current.Web.CurrentUser.Sid

Once you have the mapping, you can import any data from Active Directory to SharePoint list, sync the data with timer job and get the data of current logged in user from SharePoint list.