How to get user GUID from Active Directory using WinNT protocol? - active-directory

I'm trying to get user GUID from Active Directory. My code:
DirectoryEntry entry = new DirectoryEntry("WinNT://DOMAIN/UserName");
Console.WriteLine("The GUID of the ADS object:" + entry.Guid);
Console.WriteLine("The Native GUID of the ADS object:" + entry.NativeGuid);
The code above always returns d83f1060-1e71-11cf-b1f3-02608c9e7553, regardless of the user and domain.
Is it possible to get user GUID using WinNT protocol?

Check out Richard Mueller's Hilltop Lab where he has lots of spreadsheets showing all the properties the various providers expose. In particular, his list of properties that the WinNT provider exposes shows that there's no such things as a user's "GUID" or OID or anything like that exposed.
Mind you - the WinNT provider is only used for backward compatibility, and really only works well on local machine accounts.
If you want to access DOMAIN accounts, you should by all means use the LDAP provider instead - it'll give you access to all the LDAP properties on a user account.
Marc

Perhaps you mean SID (security identifier). Like a GUID it is unique, at least across the domain tree. I think the property is "objectSid". It's binary (byte[]). I can't remember how big it is (28 bytes?) but I'm pretty sure it's not a GUID.

Related

Spring Security LDAP: Bind vs. Authenticate against Active Directory in ApacheDS

What works
I developed this against our company's AD:
#Bean
public AuthenticationProvider adProvider() {
ActiveDirectoryLdapAuthenticationProvider adProvider = new ActiveDirectoryLdapAuthenticationProvider(
adConfig.getDomain(), adConfig.getUrl(), adConfig.getRootDn());
adProvider.setSearchFilter(adConfig.getSearchFilter());
adProvider.setUseAuthenticationRequestCredentials(true);
adProvider.setConvertSubErrorCodesToExceptions(true);
adProvider.setAuthoritiesMapper(authorities -> List.of(new FooAuthority("*")));
return adProvider;
}
This does work; I can log in using my company credentials. Important: I can use my sAMAccountName (which happens to be my uid as well) to log in.
Goal
Now I want to have some automated tests for certain edge cases, using a local AD. I chose ApacheDS for its cross platform availability, plus it has some Docker containers available. I use openmicroscopy/apacheds
, because it seemed active, documented and configurable, important for a rookie like me.
Problem
The problem is, I cannot log in. I traced it down to two lines in o.s.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider: while searchForUser(ctx, username) in doAuthentication(...) (line 148 in 5.0.12.RELEASE) works with my sAMAccountName (like foobar), contextFactory.createContext(env) in bindAsUser(...) (line 204 in 5.0.12.RELEASE) requires a fully qualified DN (like cn=foobar,ou=people,dc=acme,dc=com) to work.
So it seems there is some misconfiguration on my side, probably because of my misunderstanding... Seems I do need some different user to authenticate than to search afterwards? How do I configure this, and/but why does our company's AD works just fine? PS: I read about anonymous authentication, maybe our company allows such? But using Apache Directory Studio against the company's AD requires me to log in (as far as I can tell)...
LDAP based simple BIND operation always requires the distinguished name (DN) of the entry and password. Only AD allows to perform the BIND operation with samAccountName. AD is somewhat special.

Get domain\username from microsoft graph

We have an application where we store users login name in the format domain\username. We authenticate via windows and then get additional info from our database by matching the domain\username we get from the user to our database.
Now they want to move to the cloud. We authenticate users via apps in Azure AD. However, the user identifier we get back is first.last#domain.com.
I have fiddled around with https://graph.microsoft.com/v1.0/users/email and the select command to try and get the 'old' name. Howev,er I have not yet found out how to get it.
The reason they move to the cloud is that they are merging two ADs. So some users will be DomainA and some DomainB, but in the same tenant. So my first thought was to try and convert the mail to the other format. However, the two different ADs have different naming standards. One has DOMAINA\fila (two first letters from the first name and two first letters from the last name) and the other one has DOMAINB\firlas. Also it feels really ugly to try and solve it that way.
Is it possible to fetch the users loginname formatted as domain\username via Microsoft Graph?
Using the beta edition of Graph, you can obtain the user's domain and username from the onPremisesDomainName and onPremisesSamAccountName properties:
/beta/users?$select=userPrincipalName,onPremisesDomainName,onPremisesSamAccountName
The domain is stored as a FQDN so you'll need to do some translation. For example, domainName.ad.contoso.com might translate to domainName\).
This will give you a workaround so you can match up users with your internal databases. It is however only a temporary solution. Long-term, you really want to migrate to using the userPrincipalName. This is the primary user identifier and guaranteed to be unique within a given tenant.
Azure AD is a little different than the legacy Active Directory. Certain concepts from legacy AD such as Organizational Units (OUs), Group Policy Objects (GPOs), Kerberos Authentication, Lightweight Directory Access Protocol (LDAP), Domain trusts between multiple domains, and several others simply do not exist in the cloud.

Accessing Foreign Security Principals

Searching for the user michael#mycontoso.com with the objectSid S-1-5-21-1234567890-123465789-123456789-123456, I only find a Foreign Security Principal CN=S-1-5-21-1234567890-123465789-123456789-123456,CN=ForeignSecurityPrincipals,DC=contoso,DC=com.
That foreign security principal does not contain the properties I have to read, so I guess I have to access the "Home AD" of that FSP.
Does a FSP have a property that always contains the LDAP path of the user object?
Is there a standardized/recommended way how to access the Home AD?
Sadly FSP don't contain the LDAP path of the referenced object.
(if it contain one, then it needs to be replicated once the object is rename/moved)
There seems no easy way to get back the containing AD using the SID from foreign forest.
If in local forest you may do it by binding to LDAP://<SID=S-1-xxxxx>.
A not-so-easy way is to build a domain SID to domain map.
Walk through each domain in trusted forests and build the map using the script here (the "The Script Solution" section).
https://learn.microsoft.com/en-us/archive/blogs/ashleymcglone/powershell-sid-walker-texas-ranger-part-3-exporting-domain-sids-and-trusts
SID of security principals are in the form of <domain SID>-<RID>.
e.g. domain SID of S-1-5-21-1234567890-123465789-123456789-123456 is S-1-5-21-1234567890-123465789-123456789.
By extracting the domain SID (if in .NET you can do it by using SecurityIdentifier class and the AccountDomainSid property) and the map then you can find out the containing domain.
You may try to retrieve the msDS-PrincipalName:
ldapsearch <options> -b "CN=ForeignSecurityPrincipals,DC=contoso,DC=com" "CN=S-1-5-21-1234567890-123465789-123456789-123456" msDS-PrincipalName
FOO\michael#mycontoso.com
Otherwise, the approach is as https://stackoverflow.com/a/27038494/10408280 describes:
Retrieve Domain identifier from first part of SID
Perform a lookup against that domain for the SID of the user or by sAMAccountName

Store Active Directory Users in a SQL Database

I need to set a server that creates self-signed certificate when a user register in. So i thought to create a new AD account every time a new users register to the server. BUT, I need to store the user information into a sql server and i can't find a way to do this.
Any idea?
Based on what you describe and your comment:
My problem is that i think that store "public users" (that can register from the web) information into AD is insicure, so i'm trying to find another way to do that "mapping", – Stefano
What you seem to need is an AD domain with a one-way trust:
Your public users are in domain A.
Domain A trusts your internal private domain B.
Your app does AD authentication against domain domain A, and your internal users can authenticate using their full domain credentials (the request gets passed to domain B, which says yay or nay).
Note that this is coming from a guy who hasn't used Windows in a very long time.
I could be giving you terrible advice (and if I am I'm sure one of our Windows folks will clobber me for it).
If you're going to be storing external users for an application, you should be using AD LDS (formerly ADAM) instead of real AD. Or any other generic LDAP, really, but AD LDS is a lot like AD and might fit your needs better.

LDAP Active Directory path

I am trying to add a user to Active Directory through an MPS Web Service. I've been trying a long time to find the correct LDAP-url to use to tell it to add the new user to the Users group. I've tried things like:
LDAP://XXXX.YYY/OU=Users,DC=XXXX,DC=YYY
LDAP://XXXX.YYY/CN=Users,DC=XXXX,DC=YYY
LDAP://XXXX.YYY/DN=Users,DC=XXXX,DC=YYY
It seems the "farthest" I've gotten is an error that says I have given it an invalid Customer.
I really don't have a lot of experience with LDAP (pretty much none at all), so even just a good LDAP and Active Directory tutorial would be extremely useful (even that is eluding me right now). Thanks!
I've since lookup up the actual distinguished name in ADSI Edit, which was LDAP://XXXX.YYY/CN=Users,DC=XXXX,DC=YYY, but still have no luck.
You have error in your LDAP string.
Let's have examle:
user with account name User1 in organization unit Office1 where contoso.com is domain.
Object:
contoso.com/Users/Office1/User1
LDAP Path is:
LDAP://CN=User1,OU=Office1,OU=Users,DC=contoso,DC=com
Note that there is no slash in path itself
CN = Common Name
OU = Organizational Unit
DC = Domain Component
You can start with:
LDAP Query Basics
Creating a list of Users and their e-mail addresses in Exchange 2000
How Can I Get a List of All the Users Whose Passwords Never Expire?
if your domain is xxxx.yyyy.zzzz and you are search for all users; your path is:
LDAP://CN=Users,DC=xxxx,DC=yyyy,DC=zzzz
means every dot in domain replace with dc=
More directly, the default Users container (not a group) in a default Active Directory install would be CN=Users,dc=domain,dc=com
You are not clear if you are having trouble adding a user to a group, or if you are having trouble creating a user in a specific location.

Resources