User.IsInRole returns false for one group but not another

Question

I'm in these two AD groups: Group1, Group2. Why would this same code return false for Group1 and true for Group2 when I'm in both groups?

var user = new WindowsPrincipal(WindowsIdentity.GetCurrent());
if (!user.IsInRole(groupName)) { return false; }

When I check with a third-party AD tool, I can see that I'm in both groups. I've seen that there are issues with the administrator role, but I'm just checking two normal AD groups. I'm not sure where to start figuring out why one returns false and the other returns true.

This completely different approach works:

var principalContext = new PrincipalContext(ContextType.Domain, "foo.bar:389", "dc=foo,dc=bar", "account", "pw");

using (var userPrincipal = UserPrincipal.FindByIdentity(principalContext, IdentityType.SamAccountName, principal.Identity.Name))
{
    Console.WriteLine(userPrincipal.IsMemberOf(principalContext, IdentityType.SamAccountName, groupName));  // RETURNS TRUE
}

EDIT

I used a free AD tool to try and spot some differences between the two groups. The only real thing I found is that the parent containers are different. Could this have anything to do with the issue?

Parent Container
Group 1: Security Groups/NonLocationSpecific/domain.LOCAL
Group 2: CityName/Security Groups/NonLocationSpecific/domain.LOCAL

If you put a breakpoint in , what does the PrestoUser.Groups property show? — ChrisBint, Jul 22 '13 at 15:43
Is your AD account in a group that is part of group1? If so, you will need to search recursively. — Bill Sambrone, Jul 22 '13 at 15:46
@ChrisBint I see PrestoUser.Identity.WindowsIdentity.Groups. There are 159 of them, and all I see are a bunch of Sids. — Bob Horn, Jul 22 '13 at 16:08
@BillSambrone No, my AD account is directly a member of both groups. — Bob Horn, Jul 22 '13 at 16:28
It is [at the bottom the "Member Of" tab](http://i.stack.imgur.com/vPyfA.png) when you are viewing the user's info. A screenshot of that screen would actually be very helpful for us to answer your question. — Scott Chamberlain, Jul 22 '13 at 17:31
@ScottChamberlain I don't have access to that. I can email our service desk to see if they can give me that info. That will take some time. — Bob Horn, Jul 22 '13 at 17:58
@ScottChamberlain Group1 is not the primary group for that user. — Bob Horn, Jul 23 '13 at 14:51
Can you open your command prompt and do `NET USERS username /domain` and copy and paste the group memberships section here. — Scott Chamberlain, Jul 23 '13 at 15:00
I don't think my company would like me to paste that info. But I did run it and both groups show up under the Global Group memberships section. — Bob Horn, Jul 23 '13 at 15:06

User.IsInRole returns false for one group but not another

0 Answers0