Question

我正在研究一些以编程方式创建AD用户的代码（将其引入MS DYnamics CRM 2013环境），并且代码可以使用一个奇怪的怪癖。我有一个在我们的AD结构上创建的UPN列表，但由于某些原因我的AD用户没有解决它们。

所以，我有一个包含example.com的UPN后缀列表。我将用户名设置为first.last@example.com，并且不允许我使用它来登录CRM。当我检查AD条目时，我可以看到它正确地将登录名称分配给first.last@example.com，但@ example.com在列表中出现两次，即实际创建的条目和这个新条目。所以它没有认识到@ example.com是一个预先存在的UPN后缀，我不能使用first.last@example.com登录CRM，我必须使用example.local \ first.last 。我希望这是有道理的。非常感谢你。

那么，当我登录使用预先存在的UPN时，如何判断AD记录呢？不做......做什么呢？这是我的代码：

try
        {
            string connectionPrefix = "LDAP://" + ldapPath;// ldapPart;// ldapPath
            var adminUsername = ConfigurationHelper.GetConfigSettingByName(orgservice,
                            "ADPasswordReset.AdminUsername", unsecureConfig, secureConfig);
            var adminPassword = ConfigurationHelper.GetConfigSettingByName(orgservice,
                            "ADPasswordReset.AdminPassword", unsecureConfig, secureConfig);

            if (CheckIfUserExists(getSAMNameFromUserName(userName), trace) == true)
            {
                throw new Exception("A User with that name already exists.");
            }

            DirectoryEntry dirEntry = new DirectoryEntry(connectionPrefix, adminUsername, adminPassword, AuthenticationTypes.Secure);
            DirectoryEntry newUser;
            string cn = firstName + " " + lastName;
            newUser = dirEntry.Children.Add("CN=" + cn, "user"); //display name - This is the "Display" name that shows up on the AD list. 
            newUser.Properties["displayName"].Value = cn;
            newUser.Properties["samAccountName"].Value = getSAMNameFromUserName(userName);//userName; 
            newUser.Properties["userPrincipalName"].Value = checkUserName(userName);
            newUser.Properties["givenName"].Value = firstName; //Firstname
            newUser.Properties["sn"].Value = lastName; //Lastname? -Surname
            newUser.Properties["LockOutTime"].Value = 0; //unlock account. Set this to 0 to unlock the account.
            newUser.CommitChanges();
            oGUID = newUser.Guid.ToString();

            //Must be handled after the previous stuff. Unsure why.
            newUser.Invoke("SetPassword", new object[] { userPassword });
            newUser.CommitChanges();

            //For some reason, can't be handled before the password is set?
            newUser.Properties["userAccountControl"].Value = 0x0200; //0x0200
            newUser.CommitChanges();
            dirEntry.Close();
            newUser.Close();
        }

    public static string checkUserName(string userName)
    {
        if (!userName.Contains("@"))
        {
            return userName + "@example.local";
        }

        return userName;
    }

    public static string getSAMNameFromUserName(string domainUserName)
    {
        int stop;
        string s = domainUserName;

        if (s.Contains("@"))
        {
            stop = s.IndexOf("@");
            return (stop > -1) ? s.Substring(0, stop) : string.Empty;
        }
        return domainUserName;// string.Empty;
    }

Answer 1

在您的代码中，您将UPN设置为example.local而不是example.com：

public static string checkUserName(string userName)
{
    if (!userName.Contains("@"))
    {
        return userName + "@example.local";
    }

    return userName;
}

即使域配置了多个可能的后缀，用户也只能拥有一个UPN。如果您希望username@example.com解析，则用户必须设置example.com作为其后缀。

Answer 2

感谢所有花时间提供帮助的人。

空白。 Grrr，空白。

对于将来遇到此主题的任何人来说，问题在于AD创建过程中的某些内容是在我的用户名和域中附加空格。所以不是＆＃34; example.com＆＃34;它将域名保存为＆＃34; example.com＆＃34; （注意到最后的空白？）。我.Trim（）＆＃39; d所有东西，似乎工作得很好。：）

我的新代码变为：

    public static string checkUserName(string userName)
    {
        if (!userName.Contains("@"))
        {
            return userName.Trim() + "@domain.local".Trim();
        }

        return userName.Trim();
    }


try
        {
            string connectionPrefix = "LDAP://" + ldapPath;// ldapPart;// ldapPath
            var adminUserName = GetAdminUserName(orgservice, unsecureConfig, secureConfig);
            var adminPassword = GetAdminPassword(orgservice, unsecureConfig, secureConfig);

            if (CheckIfUserExists(getSAMNameFromUserName(userName), trace) == true)
            {
                trace.Trace("About to handle success. A User already exists: " + getSAMNameFromUserName(userName));
                trace.HandleSuccess();
                throw new Exception("User " + getSAMNameFromUserName(userName) + " already exists.");
            }

            DirectoryEntry dirEntry = new DirectoryEntry(connectionPrefix, adminUserName, adminPassword, AuthenticationTypes.Secure);
            DirectoryEntry newUser;
            string cn = firstName.Trim() + " " + lastName.Trim();
            newUser = dirEntry.Children.Add("CN=" + cn, "user"); //display name - This is the "Display" name that shows up on the AD list. 
            newUser.Properties["displayName"].Value = cn;
            newUser.Properties["samAccountName"].Value = getSAMNameFromUserName(userName).Trim();
            newUser.Properties["userPrincipalName"].Value = checkUserName(userName).Trim();
            newUser.Properties["givenName"].Value = firstName.Trim(); //Firstname
            newUser.Properties["sn"].Value = lastName.Trim(); //Lastname? -Surname
            //newUser.Properties["LockOutTime"].Value = 0; //unlock account. Set this to 0 to unlock the account.
            newUser.CommitChanges();
            oGUID = newUser.Guid.ToString();

            //Must be handled after the previous stuff. Unsure why.
            newUser.Invoke("SetPassword", new object[] { userPassword });
            newUser.CommitChanges();

            //For some reason, can't be handled before the password is set?
            newUser.Properties["userAccountControl"].Value = 0x10200; //0x0200
            newUser.CommitChanges();

            //http://stackoverflow.com/questions/20710535/is-there-a-way-to-set-a-new-users-domain-suffix-through-the-userprincipal-class
            newUser.Close();
            dirEntry.Close();
            //newUser.Close(); //Close user first, then dirEntry because of the heirarchy call?
        }
        catch (System.DirectoryServices.DirectoryServicesCOMException E)
        {
            System.DirectoryServices.DirectoryServicesCOMException newE = new System.DirectoryServices.DirectoryServicesCOMException(E.Message);
            //DoSomethingwith --> E.Message.ToString();
            throw newE;
        }

应用程序创建的AD用户未正确解析为upn后缀

2 个答案: