Set TTL on Active Directory Group Membership using .NET DirectoryServices

ONLINECAST

2 min read

·

06-10-2024

10

0

Share

Setting TTL on Active Directory Group Membership using .NET DirectoryServices

Problem: You need to control the duration of group membership in Active Directory, ensuring users are automatically removed after a certain period. This is useful for temporary access or membership based on specific roles or projects.

Rephrased: Imagine you have a temporary project team where members need access to specific resources. You want to ensure these users are automatically removed from the team's access group after the project ends.

Solution: By utilizing the .NET DirectoryServices library and setting a Time To Live (TTL) value on group memberships, you can automatically manage user access based on a predetermined time limit.

Scenario and Original Code

Let's say you have a group named "ProjectXTeam" and you want to add a user named "JohnDoe" with a TTL of 30 days. Here's a simple example using the .NET DirectoryServices library:

using System.DirectoryServices.ActiveDirectory;
using System.DirectoryServices;

public class SetGroupMembershipTTL
{
    public static void Main(string[] args)
    {
        // Get the group
        DirectoryEntry group = new DirectoryEntry("LDAP://CN=ProjectXTeam,OU=Projects,DC=example,DC=com");

        // Get the user
        DirectoryEntry user = new DirectoryEntry("LDAP://CN=JohnDoe,OU=Users,DC=example,DC=com");

        // Add the user to the group with TTL
        group.Invoke("Add", new object[] { user.Path });

        // Set the TTL property for the user membership
        DirectoryEntry membershipEntry = new DirectoryEntry({{content}}quot;LDAP://{group.Path}/member;{user.Path}");
        membershipEntry.Properties["ms-Mcs-AdmPwdExpirationTime"].Value = DateTime.Now.AddDays(30).ToUniversalTime().ToFileTimeUtc();
        membershipEntry.CommitChanges();
    }
}

Explanation:

1. We establish connections to the group and user objects using their LDAP paths.
2. We add the user to the group using the "Add" method.
3. We create a new DirectoryEntry object representing the user's membership within the group.
4. We set the ms-Mcs-AdmPwdExpirationTime property on the membership entry, which defines the TTL. The value is set to the current date plus 30 days, converted to UTC file time for compatibility with Active Directory.
5. We commit the changes to the directory.

Insights and Clarification

• TTL Property: The ms-Mcs-AdmPwdExpirationTime property is an Active Directory attribute specific for controlling the duration of group membership.
• Time Conversion: The DateTime value needs to be converted to UTC file time format for compatibility with Active Directory.
• Error Handling: The code provided is a basic example and should be enhanced with proper error handling and validation.
• Alternative Method: You can also utilize the DirectorySearcher class to retrieve the membership entry and modify the TTL value.

Benefits and Considerations

• Automated access management: By setting a TTL, you can avoid manual removal of users from groups, ensuring efficient and consistent access control.
• Security enhancement: Reducing the duration of unnecessary access helps limit potential security risks.
• Flexibility: You can adjust the TTL based on project timelines or specific role requirements.

References:

• Microsoft Docs: ms-Mcs-AdmPwdExpirationTime

This article provides a practical approach to setting TTL on Active Directory group membership using .NET DirectoryServices. Remember to adapt the code to your specific requirements and ensure appropriate error handling and security measures.