Search code examples
active-directoryldap

user principal name issues and LDAP

So... this question is maybe not solely a programming question but I hope one of you can shed some light on my issue:

The base need we have in our software is to query the groups a user is associated too with LDAP. For this task we actually use parts of LDAP Admin to query the user. Actually we want to query for the UserPrincipalName which at least to my knowledge is the most common way right?

So.. our problem is that the AD is setup such that the user has an UPN like foo@HUS but the user actually is bound to the domain HUS.adomain.com (aka LDAP base: dc=HUS,dc=adomain,dc=com) and searching using an UPN like [email protected] does not work - only foo@HUS works. So... the question is: Is this common? And is there a name/resource for that?

(sorry I'm quite new to that all...)

The goal would be to use as less parameters in the administration tool as possible aka only the base (and form from the base the UPN username).

Update: I found at least one resource (in German) that states that this is possible but not recommended by Microsoft for Azure AD. (aka having a different mail address than UPN )

Solution

  • When you initiate a LDAP search using a UPN like [email protected] it wont work because this value is not present in the userPrincipalName value. When you search for a user by building its UPN using all the domain suffix available in the forest, then you would not consider searching the userPrincipalName attribute.

    It is very difficult to build every constructed attribute from base for querying because every Active directory environment would be different. As you have mentioned that you would like to build the attribute from base, it may work if this is the only AD infra that you are targeting. Every AD infra would have its own ways in which it will be setup.

    However if you would want your tool to work in any AD environment you would have to consider some other parameters.

    UPN is a editable attribute . An organization can set it up or can create a user without a UPN value. Below is example of user created programmatically by using old ADSI libraries. You can repro the same by removing any users userprincipalName attribute value and the user logon account name as shown in the pictures below.

    NO UPN NOI UPN

    UPN is an optional attribute and a user account can be present in AD without it as well. Coming back to your specific environment in this environment only foo@HUS works because "HUS" might be setup as a valid domain suffix within the Active directory. You can check this by opening the domain.msc console on any domain controller or a machine with Remote Server Administration Tools installed. You would find the UPN suffix as shown below . I changed it in my environment as shown below.

    domain.msc

    The value you will add will now show up in the . If you remove HUS from here for example any existing user who have user@HUS userPrincipalName populated will get removed because this is a optional constructed attribute in AD. And you will have to setup this for all the users in the environment . For example check below after I changed the username to dh @ HUS .

    enter image description here

    The userprincipalName value also got populated with the same.

    enter image description here

    Hope this helps clarify your query and understand more on how to use the native Active directory tools to understand more while you develop your custom LDAP search functionality/tool.