Get objectSID from AD (LDAP)

[brandonbollin]

Fellow experts,
I'm trying to create a From LDAP pass, or maybe even use the uGetUserSid internal function, to get the objectSID attribute from a given entry in my target repository. I'm not having any success with uGetUserSid but I was able to bring something back on the From LDAP pass method. Problem is, when I pull up the results that show up in the SQL temp table, it's all mumbo-jumbo. The attribute is stored in LDAP as a binary attribute so what comes into IDM isn't the pretty looking S-1-5-21-xxxxxx-xxxxx format you see when you look at the attribute in an LDAP browser or ADUC.

I looked through my environment to see if there was an SAP supplied global script that would convert the binary format to text but alas, nothing. Any suggestions?

[brandonbollin]

With all respect and thanks to matt.pollicove, fellow Inventy team members were able to get a script to me that was developed for a different client that does the job. I need to make sure that it's not something proprietary that I'll get in trouble for posting but if I'm given the green light, I'll post the script.

[former_member2987]

Thanks, Brandon. One thing I've learned is that when connecting to AD is the question, someone probably has either A) seen it before or B) knows an AD SysAdmin with the solution, and then it's just a matter of transposing into something our products can understand.

Looking forward to seeing what you folks have come up with. I'd also be interested in learning more about what the use case of why this attribute is so important. Always things to learn when it comes to how we use connected systems.

[brandonbollin]

The use case is simply that they want to use the SID as the account attribute in IDM. It's a unique, searchable attribute in AD and no matter the account's location in the OU structure, you can find the account via SID. Most companies I've worked with us the distinguishedName attribute and that's 90% OK to use but if an AD admin decided to move the account to another OU, that DN changes. SID will never change so IDM can never be detached from that account. That's the thinking anyway.