1

I'm looking for a way to synchronize a users database between a piece of software and a ldap directory. Currently I'm thinking of three possibilities to keep the track of a specific user :

  • Guid : it seems to be AD-specific but I guess other directories have an equivalent unique identifier. I can use a LDAP query (&(objectClass=user)(guid=xxx)) to get the user.
  • SamAccountName : also AD-specific and searchable via a LDAP query
  • Path (DN) : should be consistent accross different LDAP providers. As I'm using the System.DirectoryServices namespace, I just have to do var userEntry = new DirectoryEntry(path, username, password); to get the user

Are there other possibilities to achieve this ? What is the most reliable way to link the users from the database with the ones from the AD directory ? What would be the impact of these solution in term of performances ?

Improve this question
2
2

sAMAccountName (or uid in most Unixy LDAPs IIRC) is not unique - its only unique within each domain.

If you want unique, you use the ObjectGUID - if a user gets renamed or moved, this is the only bit that will remain constant. That means you need this if you have totrack a user getting a new username or moved to a different ou.

Improve this answer
1

Not the answer you're looking for? Browse other questions tagged or ask your own question.