Error with UserPrincipal.GetAuthorizationGroups() method

Question

I am having an issue using the GetAuthorizationGroups method of the UserPrincipal class in a web application.

Using the following code, I am receiving \"While trying to

Answer 1

I dealt with this same problem. See discussion on similar question. https://stackoverflow.com/a/8347817/2012977

Solution is below:

public List<GroupPrincipal> GetGroups(string userName)
    {
        var result = new List<GroupPrincipal>();
        PrincipalContext ctx = GetContext(); /*function to get domain context*/
        UserPrincipal user = UserPrincipal.FindByIdentity(ctx, userName);
        if (user != null)
        {
            PrincipalSearchResult<Principal> groups = user.GetAuthorizationGroups();

            var iterGroup = groups.GetEnumerator();
            using (iterGroup)
            {
                while (iterGroup.MoveNext())
                {
                    try
                    {
                        Principal p = iterGroup.Current;
                        result.Add((GroupPrincipal) p);
                    }
                    catch (PrincipalOperationException)
                    {
                        continue;
                    }
                }
            }
        }

        return result;
    }

Answer 2

Error 5 indicates ERROR_ACCESS_DENIED, which suggests a permissions related issue. That said, the following code has just worked for me, running on Windows 7 with the website running as the default application pool:

Content of "body" of .aspx page:

<asp:GridView ID="GridView1" runat="server">
</asp:GridView>

Code-behind:

protected void Page_Load(object sender, EventArgs e)
{
    var Context = new PrincipalContext(ContextType.Domain, "logon_domain", "username", "password");
    var principal = UserPrincipal.FindByIdentity(Context, "user_to_query");
    var groups = principal.GetAuthorizationGroups();

    GridView1.DataSource = groups;
    GridView1.DataBind();
}

In my example logon_domain was the lefthand of domain_name\username, rather than the style of domain specification you'd used. My solution may or may not work for you. If it doesn't, it does point to a permissions issue somewhere.

Answer 3

Have your administrator look at the AD account for the user that returns the error code 5. I ran into that today and it turned out to be a setting on that user's account. There is a checkbox to inherit security settings that was not checked (all the other users were checked). This solved it for me.