LDAP Improvement - User object unique ID

[sneak-it]

As it stands, when users are synced via Active Directory/LDAP, users appear to be uniquely tracked by UPN or some other username-esque way of uniquely identifying folks.

We have run into an issue, where someone in the directory changes their name and email, now suddenly a new user is generated in Snipe-IT. The original user is still present with all assets and history, but does not assume the new username/email/name.

It does not appear that users are tracked via objectguid or any other proper permanent unique identification, would love to see this changed!

[swift2512]

In Active Directory Domain Services, an object's objectGUID property never changes, even if the object is renamed or moved. - https://learn.microsoft.com/en-us/windows/win32/ad/using-objectguid-to-bind-to-an-object

People can change names, surnames or their login names could be changed because of reasons and on LDAP Sync, Snipe-IT would create a completely new users for them. object GUID would prevent that and would also be useful when you need edit your users outside Snipe-IT and import back in.

I asked google and it says that different AD have different unique identifiers, so maybe this could be defined in LDAP/Active Directory settings.

[MasterCakeX5]

Interestingly I discovered that problem today as well.
LDAP sync not only doesn't track the objectGUID, it also doesn't remove users that are disabled/deleted what is a big problem for us.
Any possibility to upgrade the LDAP behaviour or have a workaround for that?

[swift2512]

@MasterCakeX5 I've enabled multi-company support and manually move all former employees from 'Company A' to 'Company B'. This way admins from 'Company A' won't see people from 'Company B'. With Snipe-IT everything you've mapped to LDAP (name, location, login state, etc.) is being overwritten/recreated when syncing LDAP so moving people away from the sight is the only option.

On my installs I've swtiched to &(objectGUID=*) for LDAP filter and looks like it's working OK. I don't see any issues.

[MasterCakeX5]

@swift2512 Just so I understand you correctly:
Today we had a person where there was an error in the pre win2k name. It was changed and Snipe now had 2 of these users, one with the wrong and one with the correct pre2k name.

Now there are 2 problems:

1. snipe just made a second user instead of updating the first one
2. snipe didnt delete the old one

will these problems be solved with adding the objectGUID filter and how would it exactly look?
At the moment the filter is:

&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))

Where would I exactly add the objectguid? cause I still only want users in the system and LDAP filter is sometimes very confusing for me

Also would that solve the problem that snipe does not delete deleted or disabled people?

[swift2512]

Snipe doesn't delete anything when you sync with AD. It only creates missing entries and updates entries you already have. If you filter your people by sAMAccountName, Snipe-IT will look for this user in it's DB and either create it or update it.
Same is valid for imports - if it doesn't find that username in Snipe-IT DB, it will create a new one.

If you delete a person from your AD, you will have to do the same in Snipe-IT manually.

[swift2512]

Few days ago one of our employees changed surname and while on our AD it was enough to edit Surname and modify a username, Snipe-IT created totally new user. So I had to move all assets from old account to new one. It doesn't happen that often, but people have tendency to get married or divorced. Also, if at some point you decide to change format of usernames in your AD, you will have to update them manually by editing your database directly, because option to edit LDAP Synced usernames via GUI is disabled.

@snipe and team, could you implement different approach for syncing users?
Now it checks for username and:
a) if it matches - user information for that username is being update;
b) if there's no such username - Snipe-IT creates new user.

But if check was done against objectguid in AD, 'duplicate' entries wouldn't be created, there wouldn't be need to move assets from user to user.

[MasterCakeX5]

Snipe doesn't delete anything when you sync with AD. It only creates missing entries and updates entries you already have. If you filter your people by sAMAccountName, Snipe-IT will look for this user in it's DB and either create it or update it. Same is valid for imports - if it doesn't find that username in Snipe-IT DB, it will create a new one.

If you delete a person from your AD, you will have to do the same in Snipe-IT manually.

I rewrote the Filter to objectGUID and the double entries still appear.

[swift2512]

I rewrote the Filter to objectGUID and the double entries still appear.

They appear because Snipe-IT uses username for syncing people from AD. You can filter your AD users by any filter you want, but as Snipe-IT still will use attribute you specify in Admin>LDAP settings Username Field for a username. And if there's no user with such username in Snipe-IT DB - new user will be created.
I've tested that on my own demo install.
Before import (Username Field set to sAMAccountName) I had 3215 users
After changing Username Field to mail I almost doubled that number (because some users were created manually in Snipe-IT and not synchronized with LDAP and some were not synchronized because their mail attribute is empty).

I've also tested this combo:
Admin>LDAP settings Username Field set to objectGUID
Admin>LDAP settings LDAP Authentication query set to sAMAccountName=

And it didn't work. :) objectGUID is HEX so may need a 'translation' before importing to Snipe-IT.

[MasterCakeX5]

Well, I think they need to rework it.
Names change, people marry, change their name and many other cases where a SID or GUID needs to be used as base for any LDAP based systems.
My AD colleague just laughed and said (in his special way): what a dumb system that goes with username instead of something unique. :(