Connect information from Azure AD to local Ad - active-directory

Question

I am building an application where users login via azure (oauth).
Now I want to find the logged in user in the local active directory, but how can I do that?
There is a promising objectId in the azure web admin ui but I can't find anywhere in my local AD.
I can't use the upn neither because the are not the same in azure as on my local ad.
There must be a way because the aad sync can keep track of changes as well.
This is the information the access token provides:
{
"aud": "00000003-0000-0000-c000-000000000000",
"iss": "https://sts.windows.net/3173e872-f73b-47d0-81c6-75e3ac726c21/",
"iat": 1637937947,
"nbf": 1637937947,
"exp": 1637943631,
"acct": 0,
"acr": "1",
"acrs": [
"urn:user:registersecurityinfo"
],
"aio": "ASQA2/8TAAAAha246r1Y5HNoFGcBvCtPqcvDnjil+dqoybNz9Gk57kk=",
"amr": [
"pwd"
],
"app_displayname": "myapp",
"appid": "b958b44a-3b5c-14ac-b245-126b7524b35c",
"appidacr": "0",
"family_name": "Lustig",
"given_name": "Linda",
"idtyp": "user",
"ipaddr": "188.31.41.234",
"name": "Linda Lustig",
"oid": "9da1be1d-af4f-4d26-a9e7-e7e7a692471b",
"onprem_sid":
"S-1-5-21-4559353447-1638600113-3447510865-117118",
"platf": "8",
"puid": "1003200160C8DCC6",
"rh": "0.AXkAcuhzMTv30EeBxnXjrHJsIUu0iLlcXaxEs0dkayUks1x5AO0.",
"scp": "openid profile email",
"sub": "zpFbfmWNaR4YWYhWKHNEf3rVHVlavGX8DVQVQpPst_c",
"tenant_region_scope": "EU",
"tid": "3173e872-b76b-27d0-51c6-75e3ac726c21",
"unique_name": "lustig#mycompany.onmicrosoft.com",
"upn": "lustig#mycompany.onmicrosoft.com",
"uti": "nAcNGfeFek6iNmBwoJ9iAQ",
"ver": "1.0",
"xms_st": {
"sub": "3CEB7AUcrDeE6SKT1qde_FXWVeK9ppxZB576-PaIfwY"
},
"xms_tcdt": 1547151622
}

Answer 1

• Whenever the Azure AD Connect runs and starts synchronizing, it runs a check on every object in the Active Directory and tries to match the existing object in Azure AD as well. There are three attributes that are used for this process, viz., userPrincipalName(UPN), proxyAddresses and sourceAnchor. Thus, a match on userPrincipalName and proxyAddresses is known as a soft match and a match on sourceAnchor is known as hard match. Also, please note that for proxyAddresses attribute, the SMTP attribute in AD is considered as primary email address and used.
• Thus, since as you said, UPN isn’t matching, you can try matching the other two attributes with on premises ones for finding the local users. Also, please note that sourceAnchor attribute is created when on premises AD attributes are first synced with Azure AD. After that, they remain the same for those identities synced and don’t change later unless changed externally. So, to locate the users based on sourceAnchor attribute, you can locate the equivalent attribute in Active Directory, i.e., ObjectGUID or ms-DS-ConsistencyGuid in on premises AD related to the identities that you are trying to locate.
Please refer the following link for more detailed information: -
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-existing-tenant#sync-with-existing-users-in-azure-ad