Authenticating local users off the network

Question

I am trying to authenticate a local user based on the username and password provided. I came across this thread: Validate a username and password against Active Directory?

Here is how I validate the user:

PrincipalContext pc = new PrincipalContext(ContextType.Machine);
bool isValid = pc.ValidateCredentials(user, pass);

It works as long as I am on a network, but if I disconnect my computer it gives me:

The network path was not found.

All I am trying to do is validate on the local machine which may or may not be a part of a network.

EDIT: UserPrincipal.FindByIdentity seems to still work with no AD, it's the pc.ValidateCredentials that is giving me trouble.

score 2 · Accepted Answer · edited May 23 '17 at 11:45

2

You should probably look into this link: How to validate domain credentials?

It seems that using the LogonUser Win32 API function is the only option if you have to be able to accomplish your validation even when AD is not online. However, not without serious drawbacks (as indicated in the thread). You need to pimp the account executing your app with a lot of privileges.

edited May 23 '17 at 11:45

Community

1
1

answered Mar 30 '11 at 21:25

Simen S

3,210
18
24

I changed the link. The linked question contains a through discussion of the topic – Simen S Mar 30 '11 at 21:31

score 2 · Answer 2 · answered Mar 30 '11 at 21:27

As you've noted, the System.DirectoryServices namespace is not very useful in a disconnected context -- you need to talk to the LSA, not its Active Directory parent.

I don't know of an official .Net API that corresponds to advapi32.LogonUser, but you can call it to validate against a locally cached logon. If the machine has network access but can't see a domain controller, though, it may take a while to return.

The function has a declaration on pinvoke.net if you want to call it via P/Invoke. (I haven't reviewed it, though; I've found that the quality of signatures on pinvoke.net varies wildly.)

score 1 · Answer 3 · answered Mar 30 '11 at 22:11

1

A possible ugly workaround -

Using ValidateCredentials() with ContextType.Machine will always check the credentials against the local system first. It only performs network activity if the credentials are NOT found locally. You could catch the PrincipalOperationException if thrown and safely ignore it, knowing that if the method got this far the credentials are not valid.

answered Mar 30 '11 at 22:11

ScottTx

1,483
8
12

1

I only want to check it locally, the problem is that it seems to not get that far if there is no active directory (network cable disconnected). – Serge Mar 30 '11 at 22:36

score 0 · Answer 4 · edited Jun 15 '16 at 15:36

bool valid = false;
using (PrincipalContext checkpass = new PrincipalContext(ContextType.Machine)) //checks local machine first
{
  try // you need to use try catch when you only have local user
  {
      valid = checkpass.ValidateCredentials(user, password);
  }
  catch (Exception ex) { valid = true; }
  if (valid)
  {
       // returns ok   
  }
  else
  {
      // returns false
  }

Authenticating local users off the network

4 Answers4