What is the proper way to authenticate a set of domain credentials? Should not be granted to any arbitrary user just so that they canĪdditionally, a call to LogonUser() will fail if a blank password is specified. Handing out the ' Act as a part of the operating system' privilege is not something you want to do willy-nilly - as Microsoft points out in a knowledge base article: This sounds nice, but unfortunately the calling user sometimes needs a permission usually only given to the operating system itself: Others have suggested using the LogonUser() API function. network failure, AD connectivity failure, memory allocation error, etc) are then mis-intrepreted as authentication failure. You're relying on an exception failure for a non-exceptional case, and assuming that means invalid username and password. This is both network, and AD server, resource consuming - and is too expensive for a simple operation like authenticating a user account. What if the otherwise valid account has no rights to read from the AD? By default all users have read access, but domain policies can be set to disable access permissions for restricted accounts (and or groups).īinding against the AD has a serious overhead, the AD schema cache has to be loaded at the client (ADSI cache in the ADSI provider used by DirectoryServices).

That is, you are reading properties from the AD using an impersonation token. You are not only authenticating a domain account, but you are also doing an implicit authorization check. There are some serious drawbacks to this approach however:

If an exception is thrown, then you know the credentials are not valid - as is suggested in this stackoverflow question. Query Active Directory with ImpersonationĪ lot of people suggest querying the Active Directory for something. I want to validate a set of credentials against the domain controller.

Validar windows xp como original