Using Active Directory Web Services in C#/Visual Studio

I recently had a need to communicate with remote Active Directory stores and since most organizations do not want to open their Active Directory repositories directly through the firewall (usually over port 389), Active Directory Web Services is ideal to accommodate this scenario.

Unfortunately, as I quickly discovered, the documentation surrounding Active Directory Web Services (ADWS) is extremely sparse.

These were the only 2 articles that I discovered on it through a quick Google search:

http://technet.microsoft.com/en-us/library/dd391908(v=ws.10)

http://blogs.msdn.com/b/adpowershell/archive/2009/04/06/active-directory-web-services-overview.aspx

After digging through the Powershell blog, I also came across this article:

http://blogs.msdn.com/b/adpowershell/archive/2009/10/05/how-to-view-soap-xml-messages-to-and-from-ad-webservices-and-powershell.aspx

However, none of the articles provided any comment or guidance on how to use ADWS via C#/.Net!!

Well, after hours and hours of research and investigation, I finally came up with this article: 

http://msdn.microsoft.com/en-us/library/dd357379(v=prot.10).aspx

Fortunately, it offered one crucial piece of information: it indicated that ADWS had a Mex endpoint!! (net.tcp://localhost:9389/ActiveDirectoryWebServices/mex)

Well, once I had that piece of information, I could finally create a Service Reference to it in Visual Studio:

Once I clicked OK, Visual Studio was able to generate the resultant proxy class and I could then begin using it in my C# class file.

Now as to figure out how to properly use the API, it does not seem that there is any nice .Net Framework-style documentation and code samples, but I did find some protocol examples which provide WSDL Input and Output:

http://msdn.microsoft.com/en-us/library/dd303811(v=PROT.10).aspx

Unfortunately, it is very difficult to decipher by simply examining the SOAP input messages, but you can get somewhat of a feel for the required parameters.  For example, for the ChangePassword method, the method signature is the following:

ChangePassword(string Server, string AccountDN, string NewPassword, string OldPassword, string PartitionDN)

Now if you look at the AccountManagement examples, in the SOAP request, you will see the following parameters:

1. Server-ldap:389
2. AccountDN-CN=Guest,CN=Users,DC=fabrikam,DC=com
3. NewPassword-Password2
4. OldPassword-Password1
5. PartitionDN-DC=fabrikam,DC=com

So while the API documentation is definitely far less than perfect, it is workable (with a lot of effort!! :-( )

After finding this article (http://social.technet.microsoft.com/Forums/zh/winserverDS/thread/4e442df5-7f38-4f3d-9bb0-329bfc7db324), I was also able to get this code working correctly for me:

 NetTcpBinding tcpBind = new NetTcpBinding();
            ADWSSvc.AccountManagementClient acctMgmt = new ADWSSvc.AccountManagementClient(tcpBind, new EndpointAddress("net.tcp://localhost:9389/ActiveDirectoryWebServices/Windows/AccountManagement"));
            acctMgmt.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;
            var adPrincipal = acctMgmt.GetADGroupMember("ldap:389", "CN=Domain Admins,CN=Users,DC=corp,DC=claimsauth,DC=com", "DC=corp,DC=claimsauth,DC=com", true);
            foreach (var item in adPrincipal)
            {
                Console.WriteLine(item.Name);
                Console.WriteLine(item.DistinguishedName);
                Console.WriteLine(item.SamAccountName);
                
            }

Hope that helps for all of you venturing out into the world of ADWS!!