Using ObjectSID as relationship criteria in Syncronization Rules

Hello,

I'm wondering if there's any issue with using an AD account's objectSID as the relationship criteria in my Outbound/Inbound Sync rule? Does anyone have any concerns?

Thanks!

Josh

April 22nd, 2015 3:02pm

I don't see any issues.  ObjectSID is as unique as it can be in AD.  This will also be unique in FIM Portal, as FIM will reject any objects with duplicate objectSID.

Go for it.

Free Windows Admin Tool Kit Click here and download it now
April 22nd, 2015 4:44pm

The problem is that SID sometimes is changed. To copy and paste: SIDs can sometimes change. The SID for a Group object won't change. The values of other object properties can change, but the Object-GUID never changes. When an object is assigned a GUID, it keeps that value for life.

SID vs. GU

April 23rd, 2015 4:07am

Sid changes only if you delete the object and create a new one with same name. Sid contains the history of the object's activ
Free Windows Admin Tool Kit Click here and download it now
April 23rd, 2015 6:25am

Sid changes only if you delete the object and create a new one with same name. Sid contains the history of the object's activ
April 23rd, 2015 8:46am

When object moves to another domain, it is a different object (for all intends and purposes).  In that case, we need to have a different AD MA, don'

Free Windows Admin Tool Kit Click here and download it now
April 23rd, 2015 8:50am

I currently have one AD MA that has a relationship criteria based on accountName -> sAMAccountName. I'm asking this question because I would like to create a AD MA for a child domain where there's a possibility of duplicate usernames. If I were to use accountName -> sAMAccountName for the second domain, FIM would link these accounts. By using the ObjectSID for the second domain, duplicate users accounts will be separated in FIM. Assuming the AD object is never moved to another domain, do you think this approach is works?

April 23rd, 2015 9:26am

And this is the perfect case when you will use ObjectSID.  You can also use a compound sAMAccountName+DomainName which is always unique.
Free Windows Admin Tool Kit Click here and download it now
April 23rd, 2015 9:28am

What if we assume that the object will not be migrated to a different domain? Do you have another suggestion for the relationship criteria?
April 23rd, 2015 10:54am

compound (sAMAccountName+DomainName)
Free Windows Admin Tool Kit Click here and download it now
April 23rd, 2015 11:00am

Hi

objectsid from AD is stored as binary in fim portal. you may need additional attribute to process it. im using object sid as relAtionship for my home directory ma. other than above no problems.

Regards

Dhaya

May 19th, 2015 6:08am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics