The objectSid attribute about ldapcp

[kalervojankko]

Ok, thanks for the info!

[Yvand]

Hi @Tobias-08, thank you for your offer but it is no longer necessary, I finally implemented it and it will be available in the next version, that I hope to release very soon :)

[Tobias-08]

@Yvand Perfect, thanks!

[Yvand]

Hi Vegard,
indeed objectSid attribute is not supported because it requires to convert value between hexadecimal and string, which is not handled.
In the past I already investigated the feasibility and it didn't sound difficult to implement, but to be honest it's not my todo list for the moment.
thanks,
Yvan

[Veggern]

Thanks for reply Yvand. Just wanted clarification/confirmation. I would pobably stick to the augmentation future which works like a charm. At least until AD admin starts restructuring :P

Vegard

[kalervojankko]

Hi,

I know this is an old post, but just wanted to know if this SID to string feature has been implemented in LDAPCP? =)

I'm currently in a situation where a new organization is moving to use our intranet and they are constantly renaming their AD Groups for various reasons and they have to remove those old AD groups from our Intranet sites and add again with the new names for them to function. They have been using Group SIDs in their old intranet so they have had no issues before with renaming AD groups. I don't know yet if they have had some kind of conversion from SID to string to show the actual Group Names in Sharepoint, but I'm sure that they are not using LDAPCP in their old intranet.

I just found out from a post from another site that this is how it is if using Role claims in ADFS. To solve the issue we should change from using Role claim to Group SID claim for AD groups, but as mentioned in this post that would display those AD groups only with those SIDs which is not useful for users.

[Yvand]

Hi, I understand the impact in your scenario and indeed, SID would address it, but LDAPCP still does not support SID.
Implementing it would be quite a big work

[Tobias-08]

Hi, I am interested in implementing this.

@Yvand: Would you mind sharing the main steps needed for this feature? My naive approach for the conversion would have been using the SecurityIdentifier class. But maybe I am missing the difficulties. Where would the conversion logic have to be called?

Thanks!
Tobias