LDAP users synchronization [closed]

Question

I'm looking for a way to synchronize a users database between a piece of software and a ldap directory. Currently I'm thinking of three possibilities to keep the track of a specific user :

• Guid : it seems to be AD-specific but I guess other directories have an equivalent unique identifier. I can use a LDAP query (&(objectClass=user)(guid=xxx)) to get the user.
• SamAccountName : also AD-specific and searchable via a LDAP query
• Path (DN) : should be consistent accross different LDAP providers. As I'm using the System.DirectoryServices namespace, I just have to do var userEntry = new DirectoryEntry(path, username, password); to get the user

Are there other possibilities to achieve this ? What is the most reliable way to link the users from the database with the ones from the AD directory ? What would be the impact of these solution in term of performances ?

Answer 1

sAMAccountName (or uid in most Unixy LDAPs IIRC) is not unique - its only unique within each domain.

If you want unique, you use the ObjectGUID - if a user gets renamed or moved, this is the only bit that will remain constant. That means you need this if you have totrack a user getting a new username or moved to a different ou.