Creating a timer job for Active Directory – SharePoint profile user image synchronization

In my former post I’ve illustrated how to synchronize user images between AD and SharePoint using a custom web part in a self-service way. If you need to synchronize user images automatically you need a more advanced technique.

The user profile synchronization service in SharePoint provides a built-in solution for you, but only if you need one-way (SharePoint to AD) synchronization of images, as described in this article:

Replicating user pictures from Sharepoint 2010 to Exchange 2010 and Communications Server 14

If you would like the user images to be updated automatically in AD and SharePoint when it is changed on either end of the connection you need to apply some tricks.

(REMARK: Most of the codes for this solution are borrowed from my former post, hence I’ve include only the most relevant new snippets in the current post. The entire solution can be downloaded from here, use it at your own risk. Any feedback is welcome.)

To fulfill the requirement I’ve created a custom timer job that runs periodically and checks the images for all users in both AD and SharePoint, and if these images are different (missing on either sides or has different hash value) then the the more recent image is copied over the older one into the other system.

(REMARK: In this post I do not concentrate on the custom timer job development, just on the actual synchronization task. If you are new to timer jobs, you can find several excellent posts about this topic on the web, like this one from Andrew Connell:

Creating Custom SharePoint Timer Jobs)

But the question is: how to get the date when the image is modified in the AD and in the SharePoint profile?

It was lot easier (at least, for me) to answer the second one: the images stored in a dedicated list in the SharePoint My Site Host, so we can read the last modified date using standard SharePoint API.

After some investigation in AD and on the web I’ve found the answer to the first part as well. The LastOriginatingChangeTime property of the AttributeMetadata class (that can be accesses through the ActiveDirectoryReplicationMetadata object) gives you information about when a specific AD property was changed.

The following code snippet from the helper class ADUtils  illustrates the concept:

1. /// <summary>
2. /// Gets the time of last user photo change in AD
3. /// </summary>
4. public DateTime UserPhotoLastModified
5. {
6.     get
7.     {
8.         // if we do not find info about the property change we consider it is changed "never"
9.         DateTime lastModified = DateTime.MinValue;
10.         ActiveDirectoryReplicationMetadata rm = _domainController.GetReplicationMetadata(_userPath);
11.         AttributeMetadata am = rm["thumbnailPhoto"];
12.         if (am != null)
13.         {
14.              lastModified = am.LastOriginatingChangeTime;
15.         }
16.         return lastModified;
17.     }
18. }

The ADUtils class is initialized like this:

1. String _defaultPartition;
2. DirectoryContext _directoryContext;
3. DomainController _domainController;
4. DirectoryEntry _user;
5. String _userPath;
6.  
7. public ADUtils(String userName)
8. {
9.     String[] splittedName = userName.Split(new char[] { '\\' }, StringSplitOptions.RemoveEmptyEntries);
10.     String domainShortName = splittedName[0];
11.     String accountName = splittedName[1];
12.     _directoryContext = new DirectoryContext(DirectoryContextType.Domain, domainShortName);
13.     _domainController  = DomainController.FindOne(_directoryContext);
14.     _defaultPartition = GetDomainRoot(domainShortName);
15.     _user = FindUserByAccountName(accountName);
16.     _userPath = _user.Path.Remove(0, 7); //remove the LDAP prefix
17. }

If you read my former post in the topic you might remember that there was a web part property that stored the AD root partition. In the meantime I found a direct way to get this AD path from the short domain name:

1. /// <summary>
2. /// Retrieves the path of root AD partition
3. /// </summary>
4. /// <param name="domainShortName"></param>
5. /// <returns></returns>
6. private String GetDomainRoot(String domainShortName)
7. {
8.     Domain domain = Domain.GetDomain(_directoryContext);
9.     String domainName = domain.Name;
10.     String domainComponent = "DC=" + domainName.Replace(".", ",DC=");
11.  
12.     return domainComponent;
13. }

We can access the AD photo via the ThumbnailPhoto property of the ADUtils class:

1. /// <summary>
2. /// Gets / sets the thumbnail photo for the user
3. /// </summary>
4. public byte[] ThumbnailPhoto
5. {
6.     get
7.     {
8.         // if we do not find info about the thumbnailPhoto property we consider it is "empty"
9.         byte[] thumbnailPhotoBytes = null;
10.         if (_user.Properties.Contains("thumbnailPhoto"))
11.         {
12.             thumbnailPhotoBytes = (byte[])_user.Properties["thumbnailPhoto"].Value;
13.         }
14.         return  thumbnailPhotoBytes;
15.     }
16.     set
17.     {
18.         _user.Properties["thumbnailPhoto"].Clear();
19.         if (value != null)
20.         {
21.             _user.Properties["thumbnailPhoto"].Add(value);
22.         }
23.         _user.CommitChanges();
24.     }
25. }

I’ve created a static helper method to access profile properties easier:

1. public static class Extensions
2. {      
3.     public static String GetProfileValue(this UserProfile profile, String propertyName)
4.     {
5.         String propertyValue = String.Empty;
6.         ProfileValueCollectionBase propertyValues = profile.GetProfileValueCollection(propertyName);
7.         if ((propertyValues != null) && (propertyValues.Count != 0))
8.         {
9.             propertyValue = (String)propertyValues[0];
10.         }
11.         return propertyValue;
12.     }
13. }

After this short introduction to the code environment, let’s see the code that is responsible for the synchronization logic. In the SynchronizePhotos method we iterate through all users in the profile manager, check the user images both in AD and in the SharePoint profile, and act if the images are different:

1. public void SynchronizePhotos()
2. {
3.     using (SPSite site = new SPSite(_mySiteHostUrl))
4.     {
5.         using (SPWeb web = site.OpenWeb())
6.         {
7.             foreach (UserProfile userProfile in _profileManager)
8.             {
9.                 // using our custom extension method
10.                 String accountName = userProfile.GetProfileValue("AccountName");
11.                 Trace.TraceInformation("SynchronizePhotos: Processing user: '{0}'", accountName);
12.  
13.                 ADUtils au = new ADUtils(accountName);
14.  
15.                 DateTime adPhotoLastModified = au.UserPhotoLastModified;
16.                 // assigning a dummy value just to initialize the variable, will be updated later
17.                 DateTime spPhotoLastModified = DateTime.MinValue;
18.  
19.                 byte[] sharePointImageContent = null;
20.                 byte[] activeDirectoryImageContent = au.ThumbnailPhoto;
21.  
22.                 String pictureUrl =  userProfile.GetProfileValue("PictureUrl");
23.                 // the picture URL must refer to the image stored on My Site Host
24.                 if (!String.IsNullOrEmpty(pictureUrl))
25.                 {
26.                     SPFile file = web.GetFile(pictureUrl);
27.                     if (file.Exists)
28.                     {
29.                         Trace.TraceInformation("SP profile photo found");
30.                         SPListItem listItem = file.GetListItem(new String[] { "Modified" });
31.                         spPhotoLastModified = (DateTime)listItem["Modified"];
32.                         sharePointImageContent = file.OpenBinary();
33.                     }
34.                 }
35.  
36.                 bool hasADPhoto = (activeDirectoryImageContent != null);
37.                 bool hasSPProfilePhoto = (sharePointImageContent != null);
38.  
39.                 if ((hasSPProfilePhoto) && (hasADPhoto))
40.                 {
41.                     Trace.TraceInformation("Both AD and SP profile photos are specified, checking rules for update");
42.  
43.                     byte[] spHash = new MD5CryptoServiceProvider().ComputeHash(sharePointImageContent);
44.                     byte[] adHash = new MD5CryptoServiceProvider().ComputeHash(activeDirectoryImageContent);
45.  
46.                     bool sameImage = (Convert.ToBase64String(spHash) == Convert.ToBase64String(adHash));
47.  
48.                     // if different, try to synchronize based on last modified date in AD vs. SP
49.                     if (sameImage)
50.                     {
51.                         Trace.TraceInformation("AD and SP profile photos are the same, no further synchronization action required");
52.                     }
53.                     else
54.                     {
55.                         Trace.TraceInformation("AD photo last set: '{0}', SP profile photo last set: '{1}'", adPhotoLastModified, spPhotoLastModified);
56.                         if (spPhotoLastModified < adPhotoLastModified)
57.                         {
58.                             UpdatePhotoInSharePoint(activeDirectoryImageContent, accountName, web);
59.                         }
60.                         else
61.                         {
62.                             UpdatePhotoInActiveDirectory(sharePointImageContent, au);
63.                         }
64.                     }
65.                 }
66.                 else if (hasSPProfilePhoto)
67.                 {
68.                     Trace.TraceInformation("User has SP profile photo but no AD photo");
69.                     if (spPhotoLastModified < adPhotoLastModified)
70.                     {
71.                         Trace.TraceInformation("SP photo is older than AD last modified (deleted), delete SP photo");
72.                         DeletePhotoInSharePoint(accountName, web);
73.                     }
74.                     else
75.                     {
76.                         Trace.TraceInformation("SP photo is newer than AD last modified, copy SP photo to AD");
77.                         UpdatePhotoInActiveDirectory(sharePointImageContent, au);
78.                     }                            
79.                 }
80.                 else if (hasADPhoto)
81.                 {
82.                     UpdatePhotoInSharePoint(activeDirectoryImageContent, accountName, web);
83.                 }
84.                 else
85.                 {
86.                     Trace.TraceInformation("There is no AD or SP profile photo for user");
87.                 }
88.  
89.                 Trace.TraceInformation("SynchronizePhotos processing user: '{0}' finished", accountName);
90.             }
91.         }
92.     }
93. }

Important notes:

Before trying out the job, be sure that the SharePoint 2010 Timer service (SPTimerV4, OWSTIMER.EXE) is running, and the service account has write rights to alter Active Directory properties. For the sake of simplicity my service account has domain admin rights, but if you would like to set the permissions as recommended I suggest you to read this post, especially the section Nice, so what about actually writing back to AD (Sync)?:

Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

If you change the code it is important to restart the SharePoint 2010 Timer otherwise the new assembly won’t be loaded by the service.

The next image shows the timer job after deployment on the list of scheduled jobs:

If you click on the name of the job, the details are displayed. If you don’t want to wait for the job to be started automatically, you can click Run Now.

By clicking Run Now you will be navigated back to the list of scheduled jobs. If you would like to run the job once more but would not like to look up the job in the long list, simply click Back in Internet Explorer or use the Alt + Left Arrow key combination. After you re-deploy the solution you need to refresh the page in IE (use F5).

The code that reads and writes (copies to be exact) user images in SharePoint and AD are the same (or at least, very similar) to the previous version you can find in my former post.

As you can see, I’ve included plenty of trace commands to make it easier to track what happens during timer job installation and execution, for example by using DebugView. If you would like to follow the execution step-by-step, you can debug the timer job. Don’t forget to attach the debugger to OWSTIMER.EXE. You may find my Visual Studio extensions useful in this case.

You can test the results and modify the image for a user in SharePoint using the Manage User Profiles admin page on the Central Administration site.

If you do any changes in the profile, do not forget to click Save and Close on the top of the page to persist your changes.

To do the same in Active Directory I suggest you to install this extension that enables Active Directory Users and Computers to manage the thumbnailPhoto property a user friendly way:

Again, if you change the thumbnail, press Apply or OK.

Known issues, limitations:

If you have read the code thoughtfully, you might have already noticed that it does handle a special case the wrong way. If the same image exists both is SharePoint and AD, but deleted later in SharePoint, one can expect that the corresponding image will be deleted in the AD as well. Instead of this, the image from the AD will be copied back to SharePoint again.

The reason of this behavior is that there is no information in SharePoint (unless one would like to include audit data into the game) about when the images were deleted or when the PictureUrl property was set last time in the profile. In lack of this information we can not decide which of the systems is the current one, and we choose the action that does not cause data lost, copy the AD image to SharePoint, instead of deleting the AD image as well.

If we really need this functionality, we can replace the timer job with an event receiver that synchronize (update or delete) the corresponding AD image immediately when the SharePoint image has been changed or deleted.

This type of working would be complete by using AD change notification mechanism on the other side, something that described here:

Change Notifications in Active Directory Domain Services

Since these methods do not fit well into the timer job that is the topic of the current post, I ignore them for now. Maybe in a later post…

Synchronizing user image between Active Directory and SharePoint profile

As you may know Exchange 2010 and Outlook 2010 use the Picture attribute (better known as thumbnailPhoto based on its LDAP name) to store user and contact photos in Active Directory. You can learn more about that from this post in the Microsoft Exchange Team Blog.

Since I found no way in Outlook 2010 to set the photo, and found only (for an end user) cumbersome admin tools, like PowerShell and VBScript to upload the image. On the other side, SharePoint makes it possible for a user to upload her / his photo to the profile from the web UI easily.

Before trying to reinvent the wheel, I looked around on the web for similar solutions, but found only implementations (like this one) where an extension attribute of AD (like extensionAttribute3) was mapped to the ProfileURL SharePoint profile property.

My goal was a bit more: to synchronize the image binary as well, not only URLs. As I’ve already created tools to upload user photos from file system to SharePoint profile programmatically I thought it would be nice to reuse that knowledge on this task.

Although an ideal solution might be some kind of server process (for example a timer job), for the sake of simplicity and visibility I chose a Visual Web Part-based “self-service” implementation.

Let’s see the results first. You can find the code and the binaries as a single file download here.

When deploy the solution, you have to add the Profile Photo Sync WebPart to a page…

…and set its Root application partition property to the root of your AD.

Assuming there is no user photo in the profile nor in the AD, you should see something similar first:

Let’s upload our photo quickly to our SharePoint profile. It is done, the image is shown on the profile page. Let’s back to the web part. But wait a minute! The photo is still not visible there! What happened? I told you: wait a minute. SharePoint requires about one minute to push the profile property changes to the site. After it is done, the image is visible in the web part as expected:

If you press the >> button, the image is transferred to AD.

Now delete the image from the profile and refresh the page. The image can be found in the AD, but not in the SharePoint profile.

Try to load it back to SharePoint by pressing the << button. It seems to have no effect, but again you should wait a minute to see the result:

If you delete the image from the SharePoint profile again, refresh the page and now click on the >> button, you find that the photo is deleted from the AD as well and we are back to our starting point. Synchronizing an empty thumbnailPhoto property from AD to SharePoint profile deletes the image from the profile as well.

After this short demo let’s see some code blocks.

Since our control has to know where to look for AD properties we have to provide this iannformation for it. The web part has a property called DefaultPartition. The value of this property is forwarded to the user control in the CreateChildControls method.

1. [Personalizable(),
2. WebBrowsable(),
3. WebDisplayName("Root application partition")]
4. public string DefaultPartition
5. {
6.     get;
7.     set;
8. }
9. #endregion
10.  
11. protected override void CreateChildControls()
12. {
13.     ProfilePhotoSyncWebPartUserControl control = (ProfilePhotoSyncWebPartUserControl)Page.LoadControl(_ascxPath);
14.     control.DefaultPartition = DefaultPartition;
15.     Controls.Add(control);
16. }

The RefreshControls method is responsible for rendering the content of the UI. Since there is no built-in way to refer the thumbnailPhoto property in the AD via a URL, I made a quick and dirty hack there. If the request URL contains the UserName query string parameter, we clears the response, get the binary content from the thumbnailPhoto property and push that content to the response.

If the UserName query string parameter is not found in the request URL and the thumbnailPhoto property is not empty, I set the image URL of the AD image to the URL of the current page appending the current user name in the UserName query string parameter.

Similarly, if the PictureUrl user profile property is not empty in SharePoint I set the image URL for the SharePoint image to the value stored in the PictureUrl property.

If one or both of the properties would be empty then the corresponding image is hidden and a No photo label is shown as you can see on the images above.

1. private void RefreshControls()
2.         {
3.             String userName = Request.QueryString["UserName"];
4.  
5.             // hack: render response as image for AD "thumbnailPhoto" image
6.             if (!String.IsNullOrEmpty(userName))
7.             {
8.                 Response.Clear();
9.                 ADUtils adUtils = new ADUtils(DefaultPartition);
10.                 using (DirectoryEntry root = adUtils.GetDefaultPartition())
11.                 using (DirectoryEntry user = adUtils.FindUserByAccountName(userName))
12.                 {
13.                     byte[] thumbnailPhotoBytes = (byte[])user.Properties["thumbnailPhoto"].Value;
14.                     if (thumbnailPhotoBytes != null)
15.                     {
16.                         Response.BinaryWrite(thumbnailPhotoBytes);
17.                     }
18.  
19.                 }
20.                 Response.End();
21.             }
22.             else
23.             {
24.                 try
25.                 {
26.                     ADUtils adUtils = new ADUtils(DefaultPartition);
27.                     using (DirectoryEntry root = adUtils.GetDefaultPartition())
28.                     using (DirectoryEntry user = adUtils.FindUserByAccountName(_shortName))
29.                     {
30.                         byte[] thumbnailPhotoBytes = (byte[])user.Properties["thumbnailPhoto"].Value;
31.                         bool hasThumbnailPhoto = (thumbnailPhotoBytes != null);
32.                         ADImage.Visible = hasThumbnailPhoto;
33.                         ADImageLabel.Visible = !hasThumbnailPhoto;
34.  
35.                         if (hasThumbnailPhoto)
36.                         {
37.                             ADImage.ImageUrl = String.Format("{0}?UserName={1}", Request.Url.GetLeftPart(UriPartial.Path), _shortName);
38.                         }
39.  
40.                     }
41.                 }
42.                 catch (Exception ex)
43.                 {
44.                     Warning.Visible = true;
45.                 }
46.  
47.                 UserProfileManager userProfileManager = new UserProfileManager(SPServiceContext.Current);
48.                 UserProfile userProfile = userProfileManager.GetUserProfile(_accountName);
49.  
50.                 String pictureUrl = (String)userProfile["PictureUrl"].Value;
51.  
52.                 bool hasProfilelPhoto = (!String.IsNullOrEmpty(pictureUrl));
53.  
54.                 // double check to be sure the file is there to avoid "missing" images on the page
55.                 // when removing the profile image on the UI it takes some time the change get reflected
56.                 // in the profile property, but image is deleted immediately
57.                 if (hasProfilelPhoto)
58.                 {
59.                     using (SPSite site = new SPSite(pictureUrl))
60.                     {
61.                         using (SPWeb web = site.OpenWeb())
62.                         {
63.                             SPFile file = web.GetFile(pictureUrl);
64.                             hasProfilelPhoto = file.Exists;
65.                         }
66.                     }
67.                 }
68.  
69.                 SPImage.Visible = hasProfilelPhoto;
70.                 SPImageLabel.Visible = !hasProfilelPhoto;
71.  
72.                 if (hasProfilelPhoto != null)
73.                 {
74.                     SPImage.ImageUrl = pictureUrl;
75.                 }
76.  
77.             }
78.         }

When you click on the >> button to copy SharePoint profile image to AD the following code is called:

1. protected void SP2AD_Click(object sender, EventArgs e)
2.         {
3.  
4.             UserProfileManager userProfileManager = new UserProfileManager(SPServiceContext.Current);
5.             UserProfile userProfile = userProfileManager.GetUserProfile(_accountName);
6.  
7.             String pictureUrl = (String)userProfile["PictureUrl"].Value;
8.  
9.             bool hasProfilelPhoto = (!String.IsNullOrEmpty(pictureUrl));
10.  
11.             byte[] imageContent = null;
12.  
13.             // double check to be sure the file is there to avoid "missing" images on the page
14.             // when removing the profile image on the UI it takes some time the change get reflected
15.             // in the profile property, but image is deleted immediately
16.             if (hasProfilelPhoto)
17.             {
18.                 using (SPSite site = new SPSite(pictureUrl))
19.                 {
20.                     using (SPWeb web = site.OpenWeb())
21.                     {
22.                         SPFile file = web.GetFile(pictureUrl);
23.                         if (file.Exists)
24.                         {
25.                             imageContent = file.OpenBinary();
26.                         }
27.                     }
28.                 }
29.             }
30.  
31.             ADUtils adUtils = new ADUtils(DefaultPartition);
32.             using (DirectoryEntry root = adUtils.GetDefaultPartition())
33.             using (DirectoryEntry user = adUtils.FindUserByAccountName(_shortName))
34.             {
35.                 user.Properties["thumbnailPhoto"].Clear();
36.                 if (imageContent != null)
37.                 {
38.                     user.Properties["thumbnailPhoto"].Add(imageContent);
39.                 }
40.                 user.CommitChanges();
41.  
42.             }
43.  
44.             RefreshControls();
45.  
46.         }

Similarly, when you click << to copy image from AD to the SharePoint profile, the following code gets executed:

1. protected void AD2SP_Click(object sender, EventArgs e)
2.       {
3.           try
4.           {
5.               ADUtils adUtils = new ADUtils(DefaultPartition);
6.               using (DirectoryEntry root = adUtils.GetDefaultPartition())
7.               using (DirectoryEntry user = adUtils.FindUserByAccountName(_shortName))
8.               {
9.                   byte[] thumbnailPhotoBytes = (byte[])user.Properties["thumbnailPhoto"].Value;
10.                   bool hasThumbnailPhoto = (thumbnailPhotoBytes != null);
11.                   ADImage.Visible = hasThumbnailPhoto;
12.                   ADImageLabel.Visible = !hasThumbnailPhoto;
13.  
14.                   if (hasThumbnailPhoto)
15.                   {
16.                       using (SPSite site = new SPSite(GetMySiteHostUrl(SPContext.Current.Site)))
17.                       {
18.                           site.AllowUnsafeUpdates = true;
19.                           using (SPWeb web = site.OpenWeb())
20.                           {
21.                               web.AllowUnsafeUpdates = true;
22.                               ProfileImagePicker profileImagePicker = new ProfileImagePicker();
23.                               InitializeProfileImagePicker(profileImagePicker, web);
24.                               SPFolder subfolderForPictures = GetSubfolderForPictures(profileImagePicker);
25.  
26.                               UploadPhoto(_accountName, thumbnailPhotoBytes, subfolderForPictures);
27.                               SetPictureUrl(_accountName, subfolderForPictures);
28.                           }
29.                       }
30.                   }
31.               }
32.           }
33.           catch (Exception ex)
34.           {
35.               Warning.Visible = true;
36.           }
37.  
38.           RefreshControls();
39.  
40.       }

Helper methods in the AD2SP_Click method (UploadPhoto, SetPictureUrl, GetMySiteHostUrl etc.) are similar to the ones used in my former solutions here and here.

Active Directory related code is included in the ADUtils class (see credits later):

1. public class ADUtils
2.     {
3.  
4.         public ADUtils(String defaultPartition)
5.         {
6.             DefaultPartition = defaultPartition;
7.         }
8.  
9.         private String DefaultPartition
10.         {
11.             get;
12.             set;
13.         }
14.  
15.         /// <summary>
16.         /// Retrieves a DirectoryEntry using configuration data
17.         /// </summary>
18.         /// <param name="path"></param>
19.         /// <returns></returns>
20.         public DirectoryEntry CreateDirectoryEntry(string path)
21.         {
22.             return new DirectoryEntry(String.Format("LDAP://{0}", path));
23.         }
24.  
25.         /// <summary>
26.         /// Creates a DirectoryEntry from the DefaultPartition defined in config
27.         /// </summary>
28.         /// <returns></returns>
29.         public DirectoryEntry GetDefaultPartition()
30.         {
31.             return CreateDirectoryEntry(DefaultPartition);
32.         }
33.  
34.         /// <summary>
35.         /// Simple method to find and return a user using the CN name and searching the
36.         /// defaultNamingContext defined in config.
37.         /// </summary>
38.         /// <param name="userRDN"></param>
39.         /// <returns></returns>
40.         public DirectoryEntry FindUserByCN(string userRDN)
41.         {
42.             using (DirectoryEntry searchRoot = GetDefaultPartition())
43.             {
44.                 DirectorySearcher ds = new DirectorySearcher(
45.                     searchRoot,
46.                     String.Format("(cn={0})", userRDN),
47.                     new string[] { "cn" },
48.                     SearchScope.Subtree
49.                     );
50.  
51.                 SearchResult sr = ds.FindOne();
52.  
53.                 return (sr != null) ? sr.GetDirectoryEntry() : null;
54.             }
55.         }
56.  
57.         /// <summary>
58.         /// Simple method to find and return a user using the sAMAccountName name and searching the
59.         /// defaultNamingContext defined in config.
60.         /// </summary>
61.         /// <param name="userRDN"></param>
62.         /// <returns></returns>
63.         public  DirectoryEntry FindUserByAccountName(string accountName)
64.         {
65.             Trace.TraceInformation("FindUserByAccountName method called. Account name: '{0}'", accountName);
66.             using (DirectoryEntry searchRoot = GetDefaultPartition())
67.             {
68.                 DirectorySearcher ds = new DirectorySearcher(
69.                     searchRoot,
70.                     String.Format("(sAMAccountName={0})", accountName),
71.                     new string[] { "sAMAccountName" },
72.                     SearchScope.Subtree
73.                     );
74.  
75.                 SearchResult sr = ds.FindOne();
76.                 Trace.TraceInformation("FindUserByAccountName user found. Path: '{0}'", sr.Path);
77.                 return (sr != null) ? sr.GetDirectoryEntry() : null;
78.             }
79.         }
80.  
81.     }

Note: The sample web part provided “as is”, and is intended to be used only as a proof of concept.

Important point on security: The sample should work only when at least two of the followings are located on the same computer: browser, SharePoint 2010 front end, Active Directory domain controller. If all of these three are located on a different computer and there is no Kerberos implemented then you should be prepared for the so-called double hops issue.

My general recommendation for that problem is accessing the resource (in this case the AD) using a service user account that has access to all the requested information. One can store the service account credentials for example in SSO or in an encrypted configuration parameter.

Implementing this features require some modifications in the current code. For example, you have to use a DirectoryEntry constructor in the CreateDirectoryEntry method of ADUtils class that has user name and password parameters.

You will not have such issues if you alter the solution to a server process, like timer job that runs as a dedicated user account.

Credits: I would like to say thanks to Joe Kaplan and Ryan Dunn for their book The .NET Developer’s Guide to Directory Services Programming. The book and the code samples are definitely a must for every .NET programmer who wants (or has) to dive into the beauty of Active Directory programming. The ADUtils class in my sample is based on a solution found in the book.