WindowsPrincipal.IsInRole() is Being Flaky. Help!!

[David Jessee]

Its just being inconsistent.

I'm in 3 different Groups in AD.

..IsInRole("Groupx") returns true
..IsInRole("Groupy") returns true
..IsInRole("Groupz") returns FALSE

All of these groups reside in the same location in my AD tree, but for some
reason, the one is returning False.

even stranger, if I do a search for "Groupz" and list out its members
(through DirectoryServices) my account information shows up.

I have no idea why my account is in the group, but that lookup doesn't work
for the group, but it dows for others.

Ideas??
Anyone??
I'm not proud, I'll beg, I'll make cheesecake!

[Joe Kaplan \(MVP - ADSI\)]

Is the group security enabled? What type of group is it (groupType)?

Joe K.

"David Jessee" <DavidJessee@discussions.microsoft.com> wrote in message
news:9CE609AB-6DCC-4F44-9F34-B2B5E9604529@microsoft.com...

> Its just being inconsistent.
>
> I'm in 3 different Groups in AD.
>
> .IsInRole("Groupx") returns true
> .IsInRole("Groupy") returns true
> .IsInRole("Groupz") returns FALSE
>
> All of these groups reside in the same location in my AD tree, but for
> some
> reason, the one is returning False.
>
> even stranger, if I do a search for "Groupz" and list out its members
> (through DirectoryServices) my account information shows up.
>
> I have no idea why my account is in the group, but that lookup doesn't
> work
> for the group, but it dows for others.
>
> Ideas??
> Anyone??
> I'm not proud, I'll beg, I'll make cheesecake!

[David Jessee]

The Scope is Global, the Group Type is Security.

Okay, folks, I'm gonna up the antie. Anyone want Fudge? Home made!!

"Joe Kaplan (MVP - ADSI)" wrote:

> Is the group security enabled? What type of group is it (groupType)?
>
> Joe K.
>
> "David Jessee" <DavidJessee@discussions.microsoft.com> wrote in message
> news:9CE609AB-6DCC-4F44-9F34-B2B5E9604529@microsoft.com...

> > Its just being inconsistent.
> >
> > I'm in 3 different Groups in AD.
> >
> > .IsInRole("Groupx") returns true
> > .IsInRole("Groupy") returns true
> > .IsInRole("Groupz") returns FALSE
> >
> > All of these groups reside in the same location in my AD tree, but for
> > some
> > reason, the one is returning False.
> >
> > even stranger, if I do a search for "Groupz" and list out its members
> > (through DirectoryServices) my account information shows up.
> >
> > I have no idea why my account is in the group, but that lookup doesn't
> > work
> > for the group, but it dows for others.
> >
> > Ideas??
> > Anyone??
> > I'm not proud, I'll beg, I'll make cheesecake!

>
>
>

[Joe Kaplan \(MVP - ADSI\)]

Ok, that group should definitely be in the user's token then. Assuming you
definitely have the name correct, the next thing I'd do is a little
exploration on the user's token.

I'd try this reflection code to see what's actually in the user's token:

Function GetRoles(byval identity as WindowsIdentity) as String()

Dim idType As Type
idType = GetType(WindowsIdentity)
Dim result As Object =
idType.InvokeMember("_GetRoles",BindingFlags.Stati c Or
BindingFlags.InvokeMethod Or BindingFlags.NonPublic,Nothing, identity, New
Object() {identity.Token}, Nothing)
Dim roles() As String = DirectCast(result, String())
Return roles

End Function

You can use that to see the actual group list.

The next steps after this involve looking at the user's token to examine the
SIDs directly, but that is less easy.

Joe K.


"David Jessee" <DavidJessee@discussions.microsoft.com> wrote in message
news:61A825F8-D274-47D4-93CE-D788A5D6E5EE@microsoft.com...

> The Scope is Global, the Group Type is Security.
>
> Okay, folks, I'm gonna up the antie. Anyone want Fudge? Home made!!
>
> "Joe Kaplan (MVP - ADSI)" wrote:
>

>> Is the group security enabled? What type of group is it (groupType)?
>>
>> Joe K.
>>
>> "David Jessee" <DavidJessee@discussions.microsoft.com> wrote in message
>> news:9CE609AB-6DCC-4F44-9F34-B2B5E9604529@microsoft.com...

>> > Its just being inconsistent.
>> >
>> > I'm in 3 different Groups in AD.
>> >
>> > .IsInRole("Groupx") returns true
>> > .IsInRole("Groupy") returns true
>> > .IsInRole("Groupz") returns FALSE
>> >
>> > All of these groups reside in the same location in my AD tree, but for
>> > some
>> > reason, the one is returning False.
>> >
>> > even stranger, if I do a search for "Groupz" and list out its members
>> > (through DirectoryServices) my account information shows up.
>> >
>> > I have no idea why my account is in the group, but that lookup doesn't
>> > work
>> > for the group, but it dows for others.
>> >
>> > Ideas??
>> > Anyone??
>> > I'm not proud, I'll beg, I'll make cheesecake!

>>
>>
>>