LDAP and AD - Error adding user to group with C#

Question

I am trying to add a user to the group, but I am returned the following error:

Message: The server is reluctant to process the request.
Errorcode: -2147016651
Extendederror: 1359
Extendederrormessage: 0000054F: Svcerr: DSID-031A120C, problem 5003 (WILL_NOT_PERFORM), date 0
Hresult: -2147016651

I get this with the following code:

    public void UpdateUserGroup(ADEntry selectedEntry, ADEntry groupEntry, bool addUser)
    {
        DirectoryEntry selectedDirEntry = selectedEntry.ToDirectoryEntry(this.Connector.Credential);
        DirectoryEntry groupDirEntry = groupEntry.ToDirectoryEntry(this.Connector.Credential);

        if ((selectedDirEntry.SchemaClassName.Equals("user")) && (groupDirEntry.SchemaClassName.Equals("group")))
        {
            if (addUser)
            {
                groupDirEntry.Properties["member"].Add(selectedDirEntry.Path);
            }
            else
            {
                groupDirEntry.Properties["member"].Remove(selectedDirEntry.Path);
            }

            groupDirEntry.CommitChanges();
            groupDirEntry.RefreshCache();
        }
    }

The user I am using is Domainadmin. Does anyone have any suggested solution?

Grateful.

Answer 1

If you are in 3.5+ you should start using the System.DirectoryServices.Accountmanagement classes. Everything is much simpler. You have to initialize a Principalcontext and then rely on it to do the operations. I wore the same as you, it made it very easy for me to use the new namespace.

I don’t have my source here, but I think this should solve the problem. If not, let me know:

public void AddUserToGroup(string userId, string groupName) 
{ 
    try 
    { 
        using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, "COMPANY"))
        {
            GroupPrincipal group = GroupPrincipal.FindByIdentity(pc, groupName);
            group.Members.Add(pc, IdentityType.UserPrincipalName, userId);
            group.Save();
        }
    } 
    catch (System.DirectoryServices.DirectoryServicesCOMException E) 
    { 
        //doSomething with E.Message.ToString(); 

    } 
} 

public void RemoveUserFromGroup(string userId, string groupName)
{   
    try 
    { 
        using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, "COMPANY"))
        {
            GroupPrincipal group = GroupPrincipal.FindByIdentity(pc, groupName);
            group.Members.Remove(pc, IdentityType.UserPrincipalName, userId);
            group.Save();
        }
    } 
    catch (System.DirectoryServices.DirectoryServicesCOMException E) 
    { 
        //doSomething with E.Message.ToString(); 

    }
}

Answer 2

I was able to solve using the DirectoryServices, I had to use the signature that provides the user and the password. In the end the method was like this:

public void UpdateUserGroup(ADEntry selectedEntry, ADEntry groupEntry, bool addUser)
{
    if (selectedEntry.Type == ADEntryType.User && groupEntry.Type == ADEntryType.Group)
    {
        using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, this.Connector.Credential.Server, Connector.Credential.User, Connector.Credential.Password))
        {
            GroupPrincipal group = GroupPrincipal.FindByIdentity(pc, groupEntry.Name);

            if (addUser)
            {
                group.Members.Add(pc, IdentityType.Name, selectedEntry.Name);                        
            }
            else
            {
                group.Members.Remove(pc, IdentityType.Name, selectedEntry.Name);
            }

            group.Save();
        }
    }            
}

Thank you Luiz for the help.