如何通过ldap中的对象SID搜索用户

Question

We have this design when a SID from a scanned and synced with Azure AD local LDAP v3. comes back in as a part of a JWT token. I need to find the user in the local LDAP for authorization purposes. The SID comes in a well known serialized form supported by the Microsoft tools used for initial synchronization. Here's the LDAP environment:

"java.naming.provider.url" -> "ldap://AD2012.local:389"
 "java.naming.factory.initial" -> "com.sun.jndi.ldap.LdapCtxFactory"
 "com.sun.jndi.ldap.connect.timeout" -> "0"
 "java.naming.security.principal" -> "CN=Administrator,CN=Users,DC=AD2012,DC=local"
 "java.naming.security.authentication" -> "simple"
 "java.naming.security.credentials" -> "Password1"
 "java.naming.referral" -> "follow"

Please note the last one as I think it is important.

In my test I first run a search to get the user using the following string:

(&(|(objectClass=User)(objectClass=userProxy))(cn=Administrator*))

It works fine and lets me obtain the SID for this user that, after the String conversion, looks like

S-1-5-21-1061109567-1712144220-1378238271-319

But when I construct the second search string:

(&(|(objectClass=User)(objectClass=userProxy))(objectSid=S-1-5-21-1061109567-1712144220-1378238271-319))

the search result is empty. However, there's a clue: examining the result object with the debugger reveals that it has the following properties:

refEx.handleReferrals = 1
refEx.nextReferralEx = LdapReferralException: Continuation Reference ...
refEx.nextReferals.referrals[0] = ldap://DomainDnsZones.AD2012.local/DC=DomainDnsZones,DC=AD2012,DC=local

Here's the question: why does the server not follow the referrals in the second - by the SID - search? I know it does in the first as the search fails if I remove the "follow" environment property. Any input is greatly appreciated.

Answer 1

ObjectSID is painful to work with from LDAP.

ObjectSID is a binary value that needs to be converted to be used for LDAP Search Filters :

For example, suppose your SID in string form was S-1-5-21-2562418665-3218585558-1813906818-1576. In binary form, this is:

01,05,00,00,00,00,00,05,15,00,00,00,e9,67,bb,98,d6,b7,d7,bf,82,05,1e,6c,28,06,00,00

so the LDAP search filter would be:

(objectSid=\01\05\00\00\00\00\00\05\15\00\00\00\e9\67\bb\98\d6\b7\d7\bf\82\05\1e\6c\28\06\00\00)