# How to check for group membership in windows?

**URL:** <https://www.ruby-forum.com/t/how-to-check-for-group-membership-in-windows/87780>\
**Category:** Ruby\
**Created:** [March 5, 2007, 10:51pm UTC](https://www.ruby-forum.com/t/how-to-check-for-group-membership-in-windows/87780 "2007-03-05T22:51:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/da6949/32.png) [@BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/u/BallS_Donald_A_Jr_S)\
**Post date:** [March 5, 2007, 10:51pm UTC](https://www.ruby-forum.com/t/how-to-check-for-group-membership-in-windows/87780/1 "2007-03-05T22:51:02Z")

</div>

Apologies if this is too off-topic, but I can’t think of where else to  
start looking. I need to test for group membership on windows in a ruby  
program. I’ve got some authentication code working just fine:

require ‘dl/win32’

LOGON32\_LOGON\_NETWORK = 3  
LOGON32\_PROVIDER\_DEFAULT = 0  
BOOL\_SUCCESS = 1  
AdvApi32 = DL.dlopen(‘advapi32’)  
Kernel32 = DL.dlopen(‘kernel32’)

def authenticate\_user\_from\_windows(username, password, domain)

# Load the DLL functions

logon\_user = AdvApi32[‘LogonUser’, ‘ISSSIIp’]  
close\_handle = Kernel32[‘CloseHandle’, ‘IL’]

# Normalize username and domain

username = username.strip.downcase  
domain = domain.strip.downcase

# Authenticate user

ptoken = “\0” \* 4  
r,rs = logon\_user.call(username, domain, password,  
LOGON32\_LOGON\_NETWORK, LOGON32\_PROVIDER\_DEFAULT, ptoken)  
success = (r == BOOL\_SUCCESS)

# Close impersonation token

token = ptoken.unpack(‘L’)[0]  
close\_handle.call(token)  
return success  
end

and now I need some authorization help. I’ve been browsing msdn for  
hours to no avail; can anyone point me in the right direction? Merci.

Also, in the code above, should close\_handle.call(token) be invoked in  
an ensure block if logon\_user.call failed for some reason, or would that  
imply the ptoken object doesn’t need to be cleaned up?

- donald

---

<div class="post-metadata">

**Author:** ![BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/da6949/32.png) [@BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/u/BallS_Donald_A_Jr_S)\
**Post date:** [March 12, 2007, 10:59pm UTC](https://www.ruby-forum.com/t/how-to-check-for-group-membership-in-windows/87780/2 "2007-03-12T22:59:55Z")

</div>

> where else to
> 
> > start looking. I need to test for group membership on windows in a  
> > ruby program. I’ve got some authentication code working just fine:
> 
> If you need to be querying group memberships out of AD, then  
> look at the Net::LDAP library on rubyforge.

Is Net::LDAP preferred over Ruby/LDAP? There are some AD-specific  
authentication projects on RubyForge, but they all seem to be using  
Ruby/LDAP. Far be it from me to be able to discern the better library.  
🙂

- donald

---

<div class="post-metadata">

**Author:** ![BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/da6949/32.png) [@BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/u/BallS_Donald_A_Jr_S)\
**Post date:** [March 6, 2007, 12:05am UTC](https://www.ruby-forum.com/t/how-to-check-for-group-membership-in-windows/87780/3 "2007-03-06T00:05:14Z")

</div>

On 3/5/07, Ball, Donald A Jr (Library) [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Apologies if this is too off-topic, but I can’t think of where else to  
> start looking. I need to test for group membership on windows in a ruby  
> program. I’ve got some authentication code working just fine:

If you need to be querying group memberships out of AD, then look at the  
Net::LDAP library on rubyforge.

---

<div class="post-metadata">

**Author:** ![BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/da6949/32.png) [@BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/u/BallS_Donald_A_Jr_S)\
**Post date:** [March 13, 2007, 5:41am UTC](https://www.ruby-forum.com/t/how-to-check-for-group-membership-in-windows/87780/4 "2007-03-13T05:41:11Z")

</div>

Ball, Donald A Jr (Library) wrote:

> Apologies if this is too off-topic, but I can’t think of where else to  
> start looking. I need to test for group membership on windows in a ruby  
> program. I’ve got some authentication code working just fine:

In my experience, the logon call and the underlying LDAP request  
to return the tokenGroups attribute is hugely expensive. If causes  
the DC to do calls to other DCs including the GC server. We do  
this where absolutely necessary, but it definitely isn’t wise  
to do it whenever you have an authorization request to evaluate.

You should instead attempt to enumerate the group member SIDs of  
the current process token, or use one of the APIs that does this.

I’m a bit limited unfortunately in how much more help I can give,  
as I’ve been out of this space for a year or two now.

Clifford H…

---

<div class="post-metadata">

**Author:** ![BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/da6949/32.png) [@BallS\_Donald\_A\_Jr\_S](https://www.ruby-forum.com/u/BallS_Donald_A_Jr_S)\
**Post date:** [March 13, 2007, 5:42am UTC](https://www.ruby-forum.com/t/how-to-check-for-group-membership-in-windows/87780/5 "2007-03-13T05:42:11Z")

</div>

On 3/12/07, Ball, Donald A Jr (Library) [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Is Net::LDAP preferred over Ruby/LDAP? There are some AD-specific  
> authentication projects on RubyForge, but they all seem to be using  
> Ruby/LDAP. Far be it from me to be able to discern the better library.  
> 🙂
> 
> -

Not my call to make, since I’m the author of Net::LDAP :-).  
Try it and see if it helps you. At least you can easily query memberOf  
attributes for specific users.