How to search entry by sid suffix in unboundid?

Question

I noticed that I can make query with wildcards in LDAP. For example:

1.

ldapConnectionPool.search(baseDn, SearchScope.SUB, "objectSid=*")

and this search request will response all entries which has objectSid

2.

And this query will return all entries without objectSid

ldapConnectionPool.search(baseDn, SearchScope.SUB, "!(objectSid=*)")

I would like to search entry by PrimaryGroupToken so I tried to execute:

ldapConnectionPool.search(baseDn, SearchScope.SUB, "objectSid=*512")

and

ldapConnectionPool.search(baseDn, SearchScope.SUB, "objectSid=*-512")

But I receive empty resut although there are an entry in Ldap:

Is there way to avoid it ?

Answer 1

You cannot. objectSid attributes are not string attributes (DirStudio converts them for you) – they contain binary SIDs – and the domain controllers only support matching against a string SID as a special case, but exact match only. Most likely the match is done by canonicalizing both inputs into binary SID format, where wildcards wouldn't exist.

You will need to look up the domain SID (as described in a previous thread) and combine it with the RID that you have. The RID that you retrieve from primaryGroupId always goes together with the SID prefix of the domain that the user is in – not any other domain and certainly not any of the "built-in" SID prefixes.