CODEWITHSUNDEEP
c#.netwpfactive-directorywindows-authentication
Thomas
Thomas

Reputation: 605

Is the GUID Property of a UserPrinciple Object in Active Directory Unique and Non-spoofable?

We are using Windows active directory to log users in without a password. The way we are currently doing it like this:

using System.DirectoryServices.AccountManagement;

var context = new PrincipalContext(ContextType.Domain, System.Net.NetworkInformation.IPGlobalProperties.GetIPGlobalProperties().DomainName);
var result = UserPrincipal.FindByIdentity(context, IdentityType.SamAccountName, Environment.UserName);

Then we have a stored SamAccountName in our database which we match against the returned result.SamAccountName

This is definitely not secure as users could have the same SamAccountName and log in using that.

We are exploring the use of the GUID which exists on the UserPrinciple (result.GUID). My question is, is this variable non-spoofable on the windows side? Can we match the GUID that exists on the UserPrincple object with a variable we store on our database? Is this secure? Does this property always exist on an AD UserPrinciple? If not, how would we securely authenticate a user through this Windows Active Directory Login?

Upvotes: 3

Views: 393

Answers (1)

Sina Akbari
Sina Akbari

Reputation: 91

"sAMAccountName" is unique in a domain.

But you can also use both "objectSID" and "objectGIUD" for this purpose,this fields remain unchanged.

Note That If an object is moved to another domain, the objectSID changes, but not the objectGUID.

Overall, the best choice is "objectGIUD"

according to https://social.technet.microsoft.com/Forums/windowsserver/en-US/a5c0a863-cad1-4df8-a194-cb58f24ab1e6/is-objectguid-unique-in-the-domainforest?forum=winserverDS

Upvotes: 1

Related Questions