>1. In my application, when I/manager grant access to the application, you assign a user to a User Group (feature of the application). Say, I have to assign a person JOHN SMITH to the application, what value from the AD I need to know to set it into a field of my application?
>2. When a user opens/loads the application, how do you authenticate him/her? My understanding that you "get" some value from the AD for the currently logged user (in this PC) and compare it with a value in your application database. Right?
>
>First let me explain that the work I'm talking about was NOT done in FoxPro - it was in Python. I was 15 year user of FoxPro and I continue to support a few clients using FoxPro. So I continue to post/monitor this forum. And I like the people here!
>
>In my case all I cared about was if the user was active and a member of the correct group. If he/she passed they were allowed to use the program. I used a module from Tim Golden
>http://timgolden.me.uk/python/ad_cookbook.html.
>which provided all the tools I needed to get a pass no pass function working.
>
>That said, I have NOT used FoxPro to query AD. But I feel very confident that the tools are there. There was plenty of stuff I saw when I google-d "foxpro active directory". This looked like a good start:
>http://weblogs.foxite.com/stuartdunkeld/2006/08/14/determining-active-directory-group-membership/
>
>For any special features that I thought might be needed - such as having some Administrator only action. I created a user table that held special flags. But so far I haven't used it in my program. My thinking was straight forward - once pass the AD sign-in I had access to the database and could determine what the user permissions might be. But like I said never used it.
>
>Johnf

Thank you for the explanation. In my case (aside from difference between python and VFP) not every person who passed AD would be allowed to use the app. Plus, in my app Administrator different users would have to be assigned to different Business Areas. So I will need the access to AD, for both assigning a user to my app Business Areas to checking (on log in) what data this user is allowed access (based on the Business Area) (I am a bit simplifying though).
I will check the link you provided and look for others. (I am still not sure though if the customer will allow me this approach but I want to explore it).

PS As to you statement "And I like the people here!" it simply shows the lack of good judgment :)