AD - LDAP error timeout in search with DirectoryEntry

Question

I am connecting to the AD with this:

public void ValidateCredentials(string username, string password, out ClaimsIdentity identity)
    {
        using (DirectoryEntry entry = new DirectoryEntry())
        {
            entry.RefreshCache();
            entry.Username = username;
            entry.Password = password;
            DirectorySearcher searcher = new DirectorySearcher(entry);
            searcher.ClientTimeout = TimeSpan.FromMinutes(2);
            searcher.ServerTimeLimit = TimeSpan.FromMinutes(2);
            searcher.Filter = "(&(&(objectclass=user)(objectcategory=person))" +
            "sAMAccountName=" + username + ")";
            SearchResult srResult = searcher.FindOne();

            identity = new ClaimsIdentity();
            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, username));
        }
    }

With that, if I put a user and password wrong, it gives me a wrong user or password error, if I put a correct user and password, it allows me to log in, but if I put a username that exists and a wrong password, it gives me a timeout error (at 30 seconds):

This operation returned because the timeout period expired.

Try to increase the timeout time with ClientTimeout and ServerTimeLimit but nothing happened.

Also try doing it with this:

string filter = "(&(&(objectclass=user)(objectcategory=person))" +
            "sAMAccountName=username)";
        NetworkCredential credentials = new NetworkCredential(username, password);
        LdapDirectoryIdentifier directoryIdentifier =
           new LdapDirectoryIdentifier("LDAP://DC=domain,DC=com", 389, false, false);
        using (LdapConnection connection =
           new LdapConnection(directoryIdentifier, credentials, AuthType.Basic))
        {
            connection.Timeout = new TimeSpan(0, 0, 90);
            connection.SessionOptions.ProtocolVersion = 3;
            SearchRequest search =
                new SearchRequest(username, filter, System.DirectoryServices.Protocols.SearchScope.Base, "mail");
            SearchResponse response = connection.SendRequest(search) as SearchResponse;
            foreach (SearchResultEntry entry in response.Entries)
            {
                Console.WriteLine(entry.Attributes["mail"][0]);
            }
        }

But the server gave me an error that I did not support it.

I am open to ideas.

Thanks in advance.

Greetings

Edit: I add in case it is of any use, that we are doing this through a VPN that is capable of slowing things down.

Unfortunately, I can't replicate this. I copied your code, but if I give it a correct username and incorrect password, I get a "user name or password is incorrect" exception immediately. — Gabriel Luci
Is there a reason you're calling entry.RefreshCache()? Removing it may not fix your issue, but it is totally unnecessary and will just slow your method. (that tells it to get the values of all the existing attributes for the object it bound to, probably the root node of the domain) — Gabriel Luci
Hi good day!! Thank you for your answers,I added it (entry.RefreshCache()) because, as I read, it could improve the performance of the query, but if you say that it is not necessary to take it out, thank you very much. — Marco Nuñez

Marco Nuñez Marco Nuñez · Accepted Answer · 2020-07-24T14:37:25

The problem was that the LDAP url they gave me was not well optimized, they gave me a new url and the problem was fixed

AD - LDAP error timeout in search with DirectoryEntry

1 Answers