Error in PrincipalContext.ValidateCredentials

Question

I have used below code to authenticate user with Active Directory. using (PrincipalContext principalContext1 = new PrincipalContext(ContextType.Domain, domainName)) { if (principalContext1.ValidateCredentials(userName, password)) { //code to successful login } } Getting error "The server cannot handle directory requests." in ValidateCredentials method. I have tried passing contextOptions as third parameter "ContextOptions.Negotiate | ContextOptions.Signing | ContextOptions.Sealing" in ValidateCredentials method. It resolved my error, but I came to know from msdn that it is default parameter. Why should I need to pass this? Any alternative solutions? Thanks in advance.

savan savani · Answer

Thanks Rajnesh for reply. I am using first approach you have suggested. I am using windows service that is running by local system user. When I run it with domain user it is working fine. While in local system user this approach fails. I need to pass contextOptions as third parameter "ContextOptions.Negotiate | ContextOptions.Signing | ContextOptions.Sealing" in ValidateCredentials method to make it work. On MSDN it said that you don't need to pass this third param as it is default param. Can you help me in that.. MSDN link - https://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement.contextoptions(v=vs.110).aspx#Anchor_2

Rajneesh Chaubey · Answer

There can be multiple solution: 1. If you work on .NET 3.5 or newer, you can use the System.DirectoryServices.AccountManagement namespace and easily verify your credentials: //create a "principal context" - e.g. your domain (could be machine, too) using (PrincipalContext principalContext1= new PrincipalContext(ContextType.Domain, "YOURDOMAIN" )) { // validate the credentials bool isValid = principalContext1.ValidateCredentials( "myuser" , "mypassword" ); } It's simple, it's reliable, it's 100% C# managed code on your end. 2.using DirectoryServices: using System.DirectoryServices; They allow to query an AD server directly. Here is a small sample that would do this: using (DirectoryEntry entry = new DirectoryEntry()) { entry.Username = "here goes the username you want to validate" ; entry.Password = "here goes the password" ; DirectorySearcher searcher = new DirectorySearcher(entry); searcher.Filter = "(objectclass=user)" ; try { searcher.FindOne(); } catch (COMException ex) { if (ex.ErrorCode == -2147023570) { // Login or password is incorrect } } } Also try this: using System.DirectoryServices; using (var DE = new DirectoryEntry(path, username, password) { try { DE.RefreshCache(); // This will force credentials validation } catch (COMException ex) { // Validation failed - handle how you want } } 3. With a simple function: private bool IsValidActiveDirectoryUser( string activeDirectoryServerDomain, string username, string password) { try { DirectoryEntry de = new DirectoryEntry( "LDAP://" + activeDirectoryServerDomain, username + "@" + activeDirectoryServerDomain, password, AuthenticationTypes.Secure); DirectorySearcher ds = new DirectorySearcher(de); ds.FindOne(); return true ; } catch //(Exception ex) { return false ; } }