I’m looking for a way to synchronize a users database between a piece of software and a ldap directory. Currently I’m thinking of three possibilities to keep the track of a specific user :
- Guid : it seems to be AD-specific but I guess other directories have an equivalent unique identifier. I can use a LDAP query
(&(objectClass=user)(guid=xxx))to get the user. - SamAccountName : also AD-specific and searchable via a LDAP query
- Path (DN) : should be consistent accross different LDAP providers. As I’m using the
System.DirectoryServicesnamespace, I just have to dovar userEntry = new DirectoryEntry(path, username, password);to get the user
Are there other possibilities to achieve this ? What is the most reliable way to link the users from the database with the ones from the AD directory ? What would be the impact of these solution in term of performances ?
2
sAMAccountName (or uid in most Unixy LDAPs IIRC) is not unique – its only unique within each domain.
If you want unique, you use the ObjectGUID – if a user gets renamed or moved, this is the only bit that will remain constant. That means you need this if you have totrack a user getting a new username or moved to a different ou.
1