CODEWITHSUNDEEP
active-directory
user1174790
user1174790

Reputation: 329

AD returns Objectsid as String and SecurityIdentifier is failing interprete this

Usually AD returns 'Objectsid' as a byte[]. So I type cast the value returned by AD in to byte[]. This procedure worked against several AD but not in one case. In this AD environment, I get following exception.

Exception: Unable to cast object of type 'System.String' to type 'System.Byte[]'. (System.InvalidCastException)

To debug this I started checking data-type of the value returned by AD, and it was system.string not byte[]. I printed this string and it was garbage. Then I passed this string to SecurityIdentifier() and I got exception again.

Exception: Value was invalid. Parameter name: sddlForm (System.ArgumentException)

Code:

//Using System.DirectoryServices.Protocols objects
object s = objSrEc[k1].Attributes[(string)obj3.Current][0];
string x = s.GetType().FullName;

if (x.ToLower() == "system.byte[]")
{
  byte[] bSID = ((byte[])s);
  if (bSID != null)
  {
    SecurityIdentifier SID = new SecurityIdentifier(bSID, 0); 
    String ObjectSID = SID.Value;
  }
}
else if (x.ToLower() == "system.string")
{
  SecurityIdentifier SID = new SecurityIdentifier((String)s); //ssdl excception
  String ObjectSID = SID.Value;
}

This is the first time I am seeing AD return string data for ObjectSID. I have run my code against many AD servers. I am planning to check the data-type of ObjectSID in AD schema.

Do any one come across this behavior? Should I call the Win32 api ConvertByteToStringSid()?

Thanks Ramesh

Upvotes: 2

Views: 4447

Answers (2)

Carl S
Carl S

Reputation: 11

Sorry for reviving a graveyard post, but I had the same issue a year or so ago, managed to find out why and I figured I'd at least share the reason behind this behavior.

When using the System.DirectoryServices.Protocols namespace, all attribute values should be either a) a byte array, or b) a UTF-8 string. Thing is, the developers at Microsoft figured that they should help people by returning a string when the byte array returned from the underlying LDAP API can be formatted as one, and the byte array itself when the UTF-8 conversion fails. However, this is only true for the indexer of the DirectoryAttribute class, and not for the iterator (which always returns the byte array) or the GetValues method.

The safest way to always get a byte array when you want the SID is, as previously mentioned by others, the GetValues method.

Upvotes: 1

Spyra
Spyra

Reputation: 1


I came through the same. Found this behavior normal when deal with ForeignSecurityPrincipals, however recently found this when translate attributes of built-in groups from some old Win 2K3 domains.
I don't like this as can't just ask the result attribute to tell me via GetType() what type are you and what should I do with you ( GetValues(Attribute.GetType()) ). One of the solutions was reading all attributes definition from AD schema, but this part might be a bit heavy (depends what you're looking for) although it was only a small part of overall AD processing the solution was performing.

Cheers,
Greg

Upvotes: 0

Related Questions