1

I am looking to resolve a foreign security principal (FSP) object. So I have a user object in one domain which is a member of a group in another domain. And I have my FSP as such:

CN=S-1-5-21-1943674009-604674534-4127978668-1107,CN=ForeignSecurityPrincipals,DC=external,DC=net

I know that S-1-5-21-1943674009-604674534-4127978668 is the domain SID of the remote domain, and 1107 is the rid corresponding to the actual user object in that domain. Currently, I can create a mapping between SIDs and the actual domain so I can perform searches like [ADSI]"LDAP://[domain]"

However, my issue is that the rid field of that user object is empty. So how can I pull back the specific user object if I can't search on the rid? What's more curious is that the rid value is clearly there in the objectSID attribute- so the user object has an rid value. But the actual attribute itself is null. So how can I use a search filter to get that entry explicitly? Is there certain AD configuration required to auto-populate that field?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.