I am looking to resolve a foreign security principal (FSP) object. So I have a user object in one domain which is a member of a group in another domain. And I have my FSP as such:
I know that S-1-5-21-1943674009-604674534-4127978668 is the domain SID of the remote domain, and 1107 is the rid corresponding to the actual user object in that domain. Currently, I can create a mapping between SIDs and the actual domain so I can perform searches like [ADSI]"LDAP://[domain]"
However, my issue is that the rid field of that user object is empty. So how can I pull back the specific user object if I can't search on the rid? What's more curious is that the rid value is clearly there in the objectSID attribute- so the user object has an rid value. But the actual attribute itself is null. So how can I use a search filter to get that entry explicitly? Is there certain AD configuration required to auto-populate that field?