I am trying to use the Membership API with an AD-based Authorization Manager and have met up with several problems. The examples I have found on the web all give XML-based AzMan implementations and so it has been hit-or-miss trying to get the AD-based stuff to work. Here are a few of the problems I have found so far:
Roles.GetUsersInRole() returns me a list of SID's (Security ID's) rather than the account names (as I would have expected). I have sort of worked around this by creating a SecurityIdentifier object from each string returned from GetUsersInRole() and then calling Membership.GetUser() with the SID object. That works IF the member of the AzMan role is actually a user and not a group. Two sets of questions arise here:
(a) Why does GetUsersInRole() return a SID string? Where is that documented? and
(b) Why doesn't GetUsersInRole() transitively iterate to the leaf Users ...
Go to the complete details ...