using System;
using System.Collections.Generic;
using System.DirectoryServices;
using System.Linq;
using System.Text;

namespace Lskj.Util
{
    public static class ADUtil
    {

        public static bool? ADLogin = null;
        /// <summary>
        /// LDAP绑定路径  LDAP://test.com
        /// </summary>
        public static string ADPath;//= WebConfigUtil.Get("AdPath");
        /// <summary>
        /// 管理员登录帐号
        /// </summary>
        public static string ADUser;//= WebConfigUtil.Get("AdUser");

        /// <summary>
        /// 管理员登录密码
        /// </summary>
        public static string ADPwd;//= WebConfigUtil.Get("AdPwd");

        #region GetDirectoryEntry
        /// <summary>
        /// 根据用户公共名称取得用户的 对象用户公共名称如果找到该用户，则返回用户的 对象；否则返回 null
        /// </summary>
        /// <param name="commonName"></param>
        /// <returns></returns>
        public static DirectoryEntry GetDirectoryEntry(string commonName)
        {
            DirectoryEntry de = GetDirectoryObject();
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(cn=" + commonName + "))";
            deSearch.SearchScope = SearchScope.Subtree;
            try
            {
                SearchResult result = deSearch.FindOne();
                de = new DirectoryEntry(result.Path);
                return de;
            }
            catch
            {
                return null;
            }
        }

        /// <summary>
        /// 根据用户公共名称和密码取得用户的 对象。用户公共名称用户密码如果找到该用户，则返回用户的 对象；否则返回 null
        /// </summary>
        /// <param name="commonName"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        public static DirectoryEntry GetDirectoryEntry(string commonName, string password)
        {
            DirectoryEntry de = GetDirectoryObject(commonName, password);
            de.RefreshCache();
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "";
            deSearch.SearchScope = SearchScope.Subtree;
            SearchResult result = deSearch.FindOne();
            de = new DirectoryEntry(result.Path);
            return de;
        }

        /// <summary>
        /// 根据用户帐号称取得用户的 对象用户帐号名如果找到该用户，则返回用户的 对象；否则返回 null
        /// </summary>
        /// <param name="sAMAccountName"></param>
        /// <returns></returns>
        public static DirectoryEntry GetDirectoryEntryByAccount(string sAMAccountName)
        {
            DirectoryEntry de = GetDirectoryObject();
            DirectorySearcher deSearch = new DirectorySearcher(de);
            //   deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(sAMAccountName=" + sAMAccountName + "))";
            deSearch.Filter = "(&(objectCategory=user)(sAMAccountName=" + sAMAccountName + "))";

            deSearch.SearchScope = SearchScope.Subtree;
            try
            {
                SearchResult result = deSearch.FindOne();
                de = new DirectoryEntry(result.Path, ADUser, ADPwd, AuthenticationTypes.Secure);
                return de;
            }
            catch
            {
                return null;
            }
        }

        /// <summary>
        /// 根据用户帐号和密码取得用户的 对象用户帐号名用户密码如果找到该用户，则返回用户的 对象；否则返回 null
        /// </summary>
        /// <param name="sAMAccountName"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        public static DirectoryEntry GetDirectoryEntryByAccount(string sAMAccountName, string password)
        {
            
            if (GetDirectoryEntry(sAMAccountName, password) != null)
                return GetDirectoryEntry(sAMAccountName, password);
            else
                return null;
            //DirectoryEntry de = GetDirectoryEntryByAccount(sAMAccountName);
            //if (de != null)
            //{
            //    string commonName = de.Properties["cn"][0].ToString();
               
            //}
            //else
            //{
            //    return null;
            //}
        }

        /// <summary>
        /// 根据组名取得用户组的 对象  组名
        /// </summary>
        /// <param name="groupName"></param>
        /// <returns></returns>
        public static DirectoryEntry GetDirectoryEntryOfGroup(string groupName)
        {
            DirectoryEntry de = GetDirectoryObject();
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "(&(objectClass=group)(cn=" + groupName + "))";
            deSearch.SearchScope = SearchScope.Subtree;
            try
            {
                SearchResult result = deSearch.FindOne();
                de = new DirectoryEntry(result.Path);
                return de;
            }
            catch
            {
                return null;
            }
        }
        #endregion
        #region GetDirectoryObject
        private static DirectoryEntry GetDirectoryObject()
        {
            DirectoryEntry entry = new DirectoryEntry(ADPath, ADUser, ADPwd, AuthenticationTypes.Secure);
            return entry;
        }
        private static DirectoryEntry GetDirectoryObject(string userName, string password)
        {
            DirectoryEntry entry = new DirectoryEntry(ADPath, userName, password);//, AuthenticationTypes.None
            return entry;
        }
        private static DirectoryEntry GetDirectoryObject(string domainReference)
        {
            DirectoryEntry entry = new DirectoryEntry(ADPath + domainReference, ADUser, ADPwd, AuthenticationTypes.Secure);
            return entry;
        }

        private static DirectoryEntry GetDirectoryObject(string domainReference, string userName, string password)
        {
            DirectoryEntry entry = new DirectoryEntry(ADPath + domainReference, userName, password, AuthenticationTypes.Secure);
            return entry;
        }
        #endregion
        /// <summary>
        /// 判断用户与密码是否足够以满足身份验证进而登录用户公共名称 密码 如能可正常登录，则返回 true；否则返回 false
        /// </summary>
        /// <param name="commonName"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        public static LoginResult Login(string commonName, string password)
        {

            DirectoryEntry de = GetDirectoryEntry(commonName, password);
            if (de != null)
            {
                // 必须在判断用户密码正确前，对帐号激活属性进行判断；否则将出现异常。
                int userAccountControl = Convert.ToInt32(de.Properties["userAccountControl"][0]);
                de.Close();
                if (!IsAccountActive(userAccountControl))
                    return LoginResult.LOGIN_USER_ACCOUNT_INACTIVE;
                if (GetDirectoryEntry(commonName, password) != null)
                    return LoginResult.LOGIN_USER_OK;
                else
                    return LoginResult.LOGIN_USER_PASSWORD_INCORRECT;
            }
            else
            {
                return LoginResult.LOGIN_USER_DOESNT_EXIST;
            }
        }
        /// <summary>
        /// 判断用户帐号与密码是否足够以满足身份验证进而登录 用户帐号密码如能可正常登录，则返回 true；否则返回 false
        /// </summary>
        /// <param name="sAMAccountName"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        public static LoginResult LoginByAccount(string sAMAccountName, string password)
        {
            try
            {
                if (GetDirectoryEntryByAccount(sAMAccountName, password) != null)
                    return LoginResult.LOGIN_USER_OK;
                else
                    return LoginResult.LOGIN_USER_PASSWORD_INCORRECT;
            }
            catch (Exception ex)
            {
                if (ex.Message.Contains("该目录服务不可用"))
                {
                    return LoginResult.LOGIN_USER_DOESNT_EXIST;
                }
                else
                if (ex.Message.Contains("未知的用户名或错误密码"))
                {
                    return LoginResult.LOGIN_USER_PASSWORD_INCORRECT;
                }
                else {
                    return LoginResult.LOGIN_USER_ACCOUNT_INACTIVE;
                }
            }
            


            //DirectoryEntry de = GetDirectoryEntryByAccount(sAMAccountName);
            //if (de != null)
            //{
            //    // 必须在判断用户密码正确前，对帐号激活属性进行判断；否则将出现异常。
            //    int userAccountControl = Convert.ToInt32(de.Properties["userAccountControl"][0]);
            //    de.Close();
            //    if (!IsAccountActive(userAccountControl))
            //        return LoginResult.LOGIN_USER_ACCOUNT_INACTIVE;
                
            //}
            //else
            //{
            //    return LoginResult.LOGIN_USER_DOESNT_EXIST;
            //}

        }


        /// <summary>
        /// 判断用户帐号是否激活用户帐号属性控制器如果用户帐号已经激活，返回 true；否则返回 false
        /// </summary>
        /// <param name="userAccountControl"></param>
        /// <returns></returns>
        public static bool IsAccountActive(int userAccountControl)
        {
            int userAccountControl_Disabled = Convert.ToInt32(ADS_USER_FLAG_ENUM.ADS_UF_ACCOUNTDISABLE);
            int flagExists = userAccountControl & userAccountControl_Disabled;
            if (flagExists > 0)
                return false;
            else
                return true;
        }
    }
    /// 
    /// 用户登录验证结果
    /// 
    public enum LoginResult
    {
        /// <summary>
        /// 正常登录
        /// </summary>
        LOGIN_USER_OK = 1,
        /// <summary>
        /// 用户不存在
        /// </summary>
        LOGIN_USER_DOESNT_EXIST,
        /// <summary>
        /// 用户帐号被禁用
        /// </summary>
        LOGIN_USER_ACCOUNT_INACTIVE,
        /// <summary>
        /// 用户密码不正确
        /// </summary>
        LOGIN_USER_PASSWORD_INCORRECT
    }
    public enum ADS_USER_FLAG_ENUM
    {

        /// <summary>
        /// 登录脚本标志。如果通过 ADSI LDAP 进行读或写操作时，该标志失效。如果通过 ADSI WINNT，该标志为只读。
        /// </summary>
        ADS_UF_SCRIPT = 0X0001,
        /// <summary>
        /// 用户帐号禁用标志
        /// </summary>
        ADS_UF_ACCOUNTDISABLE = 0X0002,
        /// <summary>
        /// 主文件夹标志
        /// </summary>
        ADS_UF_HOMEDIR_REQUIRED = 0X0008,
        /// <summary>
        /// 过期标志
        /// </summary>
        ADS_UF_LOCKOUT = 0X0010,
        /// <summary>
        /// 用户密码不是必须的
        /// </summary>
        ADS_UF_PASSWD_NOTREQD = 0X0020,
        /// <summary>
        /// 密码不能更改标志
        /// </summary>
        ADS_UF_PASSWD_CANT_CHANGE = 0X0040,
        /// <summary>
        /// 使用可逆的加密保存密码
        /// </summary>
        ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 0X0080,
        /// <summary>
        /// 本地帐号标志
        /// </summary>
        ADS_UF_TEMP_DUPLICATE_ACCOUNT = 0X0100,
        /// <summary>
        /// 普通用户的默认帐号类型
        /// </summary>
        ADS_UF_NORMAL_ACCOUNT = 0X0200,
        /// <summary>
        /// 跨域的信任帐号标志
        /// </summary>
        ADS_UF_INTERDOMAIN_TRUST_ACCOUNT = 0X0800,
        /// <summary>
        /// 工作站信任帐号标志
        /// </summary>
        ADS_UF_WORKSTATION_TRUST_ACCOUNT = 0x1000,
        /// <summary>
        /// 服务器信任帐号标志
        /// </summary>
        ADS_UF_SERVER_TRUST_ACCOUNT = 0X2000,
        /// <summary>
        /// 密码永不过期标志
        /// </summary>
        ADS_UF_DONT_EXPIRE_PASSWD = 0X10000,
        /// <summary>
        /// MNS 帐号标志
        /// </summary>
        ADS_UF_MNS_LOGON_ACCOUNT = 0X20000,
        /// <summary>
        /// 交互式登录必须使用智能卡
        /// </summary>
        ADS_UF_SMARTCARD_REQUIRED = 0X40000,
        /// <summary>
        /// 当设置该标志时，服务帐号（用户或计算机帐号）将通过 Kerberos 委托信任
        /// </summary>
        ADS_UF_TRUSTED_FOR_DELEGATION = 0X80000,
        /// <summary>
        /// 当设置该标志时，即使服务帐号是通过 Kerberos 委托信任的，敏感帐号不能被委托
        /// </summary>
        ADS_UF_NOT_DELEGATED = 0X100000,
        /// <summary>
        /// 此帐号需要 DES 加密类型
        /// </summary>
        ADS_UF_USE_DES_KEY_ONLY = 0X200000,
        /// <summary>
        /// 不要进行 Kerberos 预身份验证
        /// </summary>
        ADS_UF_DONT_REQUIRE_PREAUTH = 0X4000000,
        /// <summary>
        /// 用户密码过期标志
        /// </summary>
        ADS_UF_PASSWORD_EXPIRED = 0X800000,
        /// <summary>
        /// 用户帐号可委托标志
        /// </summary>
        ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 0X1000000
    }
}