title: Choosing an API for AD-based authorization in a Windows app
body: <p>We are building a rich-client app (WPF) that uses the logged-on user information for auditing and authorization.</p>
  
  <p>I'm trying to decide between three different APIs for accessing this information:</p>
  
  <ul>
  <li><code>System.Management</code> classes (WMI queries)</li>
  <li><code>System.Security.Principal</code> classes (WindowsIdentity, etc)</li>
  <li><code>System.DirectoryServices.AccountManagement</code> classes (UserPrincipal, etc)</li>
  </ul>
  
  <p>The use cases are:</p>
  
  <ul>
  <li>Get the current username</li>
  <li>Get all the users in group X</li>
  <li>Get all the groups the current user belongs to</li>
  <li>Is the current user in group X?</li>
  <li>Is user X in group Y?</li>
  </ul>
  
  <p>I have some proofs of concept for each method, but I'd like some objective reasons to use one or other. I'd appreciate facts on the following aspects:</p>
  
  <ul>
  <li>Testability</li>
  <li>Performance</li>
  <li>Ease of use</li>
  <li>Ease of deployment
  <ul>
  <li>In test/production</li>
  <li>In developer's computers</li>
  </ul></li>
  </ul>