Querying Active Directory using C# for user email by employee ID

Question

Is it possible to get a user's email from Active Directory using employeenumber as the query term?

I am using C#'s System.DirectoryServices and am a little bit lost. The previous developer at my company was using this process, but he had an email and was querying for the employee number. I have changed it to what I believe it should be, but to be honest, I don't understand the code that well.

Is there something wrong with my code? every time i run it, I get a Null Reference error on the DirectoryEntry up_user = line. I assume it is because the previous line is not getting any entities.

Also, is there any good documentation on this topic? Everywhere I look, the posts are from 2011 or 2013.

I have the following:

try
{
    string email = string.Empty;
    ContextType authenticationType = ContextType.Domain;
    PrincipalContext principalContext = new PrincipalContext(authenticationType, "MATRIC");
    UserPrincipal userPrincipal = null;

    userPrincipal = UserPrincipal.FindByIdentity(principalContext, empnum);

    DirectoryEntry up_User = (DirectoryEntry)userPrincipal.GetUnderlyingObject();
    DirectorySearcher deSearch = new DirectorySearcher(up_User);
    SearchResultCollection results = deSearch.FindAll();
    if (results != null && results.Count > 0)
    {
        ResultPropertyCollection rpc = results[0].Properties;
        foreach (string rp in rpc.PropertyNames)
        {
            if (rp == "mail") 
            {
                email = rpc["mail"][0].ToString();
            }
        }

        if (email != string.Empty)
        {
            return email;
        }

        return null;
    }
            return null;
}
catch (Exception ex)
{
    throw ex;
}

It looks like your issue is that your object keeps returning null. Have you checked out this link and explored those options -> https://stackoverflow.com/questions/37050930/userprincipal-findbyidentity-always-returns-null — Robin, Nov 16 '18 at 19:29

Gabriel Luci · Accepted Answer · 2018-11-16T20:20:51.410

UserPrincipal.FindByIdentity only works for finding a user by what AD considers an identifying attribute. These are listed in the IdentityType enumeration. The employee number isn't one of those.

Are you using employeeId or employeeNumber in AD? They are different attributes, although both are just strings with no special meaning or restrictions in AD.

The employeeId attribute is exposed in the UserPrincipal class, so you can search by it with UserPrincipal as described in the answer here:

UserPrincipal searchTemplate = new UserPrincipal(principalContext);
searchTemplate.EmployeeID = employeeId;
PrincipalSearcher ps = new PrincipalSearcher(searchTemplate);

UserPrincipal user = (UserPrincipal)ps.FindOne();

Then you can use the EmailAddress property of the account you find (you don't need to do what you're doing with the DirectorySearcher).

var emailAddress user?.EmailAddress;

If you're using employeeNumber, then you will need to use DirectorySearcher to find it. Something like this:

var search = new DirectorySearcher(new DirectoryEntry("LDAP://yourdomain.com"));
search.Filter = $"(&(ObjectClass=user)(employeeNumber={employeeNumber}))"; 
search.PropertiesToLoad.Add("mail");

var result = search.FindOne();
string emailAddress = null;
if (result.Properties.Contains("mail")) {
    emailAddress = result.Properties["mail"][0].Value as string;
}

I am using employeeNumber. So in the last block of code, the Filter says get users where employeeNumber = the EmployeeNumber I provide? Then it only loads `mail`. In the result it finds the first match of the employeeNumber and sets emailAddress to the search result? Sorry i just want to understand it — Josh, Nov 16 '18 at 20:17
Right. So that code assumes you have a variable called `employeeNumber` already. Then it sets `emailAddress` to the `mail` attribute of the user it found. — Gabriel Luci, Nov 16 '18 at 20:22

Querying Active Directory using C# for user email by employee ID

1 Answers1