Lookup Active Directory entry by implicit UPN

active-directory ldap kerberos

17,198

The way to do this is to do an LDAP query against both the sAMAccountName and the userPrincipalName. For example: ( &(sAMAccountName=uname)(userPrincipalName=*@example.com) ) would query for the user [email protected] if his sAMAccountName ("implied UPN prefix" I suppose) were uname.

Programs like adfind will allow you to run arbitrary LDAP queries such as this one against AD.

In the event that you can't rely on the UPN suffix to match the domain because that was also overridden, you could create a list of the SID parts for each domain (every part of a user's SID except the last part) and search on that. If a domain example.net had an SID part of 1234-5678-9012, users in the domain would all have an SID starting with S-1-5-21-1234-5678-9012-. If you have that mapping, you could write an LDAP search

( &(sAMAccountName=uname)(objectSID=S-1-5-21-1234-5678-9012-*) )

17,198

Michael-O

Passionate software developer with structured thinking in mind, one of few Apache Software Foundation members. Active in Apache Maven (PMC member) Apache Commons (committer) Apache HttpComponents (PMC chair) Apache Velocity (PMC member) Apache Tomcat (committer) Apache APR (PMC member) Codehaus Plexus Components msktutil WebSVN MojoHaus Contributed to curl and libcurl Checkstyle MIT Kerberos Spring Framework Cyrus SASL Apache Subversion JOpt Simple mod_spnego libserf DisplayTag sslscan FreeBSD Ports HawtJNI mod_auth_gssapi pupnp Gerbera (formerly MediaTomb) JMeter Python libutf8proc sha1collisiondetection GNU coreutils, readline Git blake2 libapr KdcProxy diffoscope colordiff asciinema Apache Directory Kerby SQLite JDBC Driver sudo gitup py-requests-negotiate-sspi FreeBSD py-gssapi py-requests-gssapi Logback libarchive and others which I already forgot. Author of JNDI DirContentSource Michael Osipov's Apache Tomcat Extras SPNEGO/Kerberos Authenticator and Active Directory Realm for Apache Tomcat Enterprise-Class Authentication for Apache Subversion FreeBSD port maintainer of Sonatype Nexus OSS 2.x PEAR GeSHi Java Service Wrapper websvn

Updated on September 18, 2022

Comments

Michael-O almost 2 years

In our company exists a forest-wide UPN suffix company.com and almost all user accounts have the explicit UPN set to [email protected]. This value is also set in the Active Directory userPrincipalName attribute.

Now we have an application where users perform authentication through Kerberos. So we are given the Kerberos principal, i.e. implicit UPN. We'd like to look up that user and retrieve several LDAP attributes. Since iUPN and userPrincipalName do not match anymore, the lookup is not possible.

Is there any "official" way to retrieve a mapping from the Active Direcory? My workaround is to perform a LDAP bind against the realm component and search for the sAMAccountName attribute which matches the user id component of the iUPN. Searching for the mere sAMAccountName in the forest is not possible because the value is unique in the domain only.
- uSlackr about 12 years
  
  Sounds like you are on the right path. Do you foresee any issues with this approach?
Michael-O almost 12 years

How is this supposed to work if the userPrincipalName attribute value does not match the implicit UPN? The sAMAccountName won't help me here.
Falcon Momot almost 12 years

Yeah, the explicit UPN suffix would definitely make that useless. However, you could use objectSID for this.
Michael-O almost 12 years

Well, this would lead me to a chicken-and-egg problem. Since I do only have a iUPN, I cannot simply turn that to the domain SID :-( I found a workaround. I thought there might be a better way to do that.