由网友(森陌夏栀)分享简介：我使用ASP.Net MVC 4.0来查询Active Directory。我想获得一个用户的组成员名单和遍历它们。我有一个奇怪的问题。为了得到我所用的组：I am using ASP.Net 4.0 MVC to query active directory. I am trying to get a list o...

我使用ASP.Net MVC 4.0来查询Active Directory。我想获得一个用户的组成员名单和遍历它们。我有一个奇怪的问题。为了得到我所用的组：

I am using ASP.Net 4.0 MVC to query active directory. I am trying to get a list of a user's group memberships and that iterate through them. I am having a weird problem. To get the groups I was using:

   PrincipalSearchResult<Principal> groups = up.GetGroups();

，当移动到IIS6在本​​地主机上的工作很好，但返回一个空集。所以，我尝试使用这样的：

Which worked great on localhost but returns an empty set when moved to IIS6. So I tried using this:

    PrincipalSearchResult<Principal> groups = up.GetAuthorizationGroups();

这在IIS6伟大的工作，但返回本地主机上的空集。这两个方法之间的区别是什么？为什么我可以使用一个在IIS6，而不是在本地主机？为什么我可以用另外一个在本地主机上，而不是在IIS6？

Which worked great on IIS6 but returns an empty set on localhost. What is the difference between these 2 methods? Why can I use one in IIS6 and not on localhost? Why can I use the other one on localhost and not in IIS6?

推荐答案

我假设 GetAuthorizationGroups（）调用到tokenGroups公元。为了阅读，您的服务帐户（或IIS机器的帐户，如果网络服务）需要Windows授权访问组在公元研究。

I assume GetAuthorizationGroups() calls in to tokenGroups in AD. To read that, your service account (or IIS machine account if Network Service) needs to be in the Windows Authorization Access group in AD.