IPrincipal.IsInRole() only works when I truncate the role names - why?

Question

I have an application that relies heavily on authorization of users. Within it, I am using IPrincipal.IsInRole() to check whether users are in the correct groups:

IPrincipal principal = Thread.CurrentPrincipal;
bool inRole = principal.IsInRole("mydomainname\some role with a long name");

This works fine for the most part, but fails (returns an incorrect result) if the principal is an instance of a WindowsPrincipal. I have found that to make it work correctly, I have to truncate the name of the role that I pass in to be 32 characters long (including the domain name and the \):

IPrincipal principal = Thread.CurrentPrincipal; // <- returns a WindowsPrincipal
bool inRole = principal.IsInRole("mydomainname\some role with a lo");

Truncating the role name then works correctly. Why? Is this a bug/feature/documented issue? I have an inkling that it may be related to Win2000 domains, but cannot find any info on it.

_{Some extra info:
This is a problem because the application can be configured to use either active directory or "custom" for its authorization ("custom" being any authorization provider that supports an interface - could be SQL-based, file-based, etc..). When custom is configured, the roles most likely do not need truncating and so I don't want to have to deal with this special case in my code. Additionally, I have another part of the application that uses classes in the System.DirectoryServices.AccountManagement namespace to look up groups memberships. This requires the full role name and does not work if they are truncated.}

Tedmann

Somebody once thought: "32 chars is enough for any role" – Hesperidin

@Henk: I like it :) The characters being 32 makes it quite hard to search for as you get lots of hits for Int32, Win32, etc... – Tedmann

Answer 1

After much trial and error, I have figured out what is going on.

When a group is created in Active Directory, it is given two names:

It seems to be that WindowsPrincipal uses the pre-Windows 2000 group name when IsInRole is called.

After searching extensively, this does not seem to be documented anywhere. The closest I got was this speculative answer to a similar question here on SO.

---

In my case, the groups I was querying against on the domain had a long name, but a truncated pre-Windows 2000 name (truncated to 32 characters for some reason). Passing in the long name does not work as it was checking against the wrong group name.

Tedmann