title: How to search a user by object SID in ldap
body: <p>We have this design when a SID from a scanned and synced with Azure AD local LDAP v3. comes back in as a part of a JWT token. I need to find the user in the local LDAP for authorization purposes.
  The SID comes in a well known serialized form supported by the Microsoft tools used for initial synchronization. Here's the LDAP environment:</p>
  
  <pre><code>"java.naming.provider.url" -&gt; "ldap://AD2012.local:389"
   "java.naming.factory.initial" -&gt; "com.sun.jndi.ldap.LdapCtxFactory"
   "com.sun.jndi.ldap.connect.timeout" -&gt; "0"
   "java.naming.security.principal" -&gt; "CN=Administrator,CN=Users,DC=AD2012,DC=local"
   "java.naming.security.authentication" -&gt; "simple"
   "java.naming.security.credentials" -&gt; "Password1"
   "java.naming.referral" -&gt; "follow"
  </code></pre>
  
  <p>Please note the last one as I think it is important.</p>
  
  <p>In my test I first run a search to get the user using the following string:</p>
  
  <pre><code>(&amp;(|(objectClass=User)(objectClass=userProxy))(cn=Administrator*))
  </code></pre>
  
  <p>It works fine and lets me obtain the SID for this user that, after the String conversion, looks like</p>
  
  <pre><code>S-1-5-21-1061109567-1712144220-1378238271-319
  </code></pre>
  
  <p>But when I construct the second search string:</p>
  
  <pre><code>(&amp;(|(objectClass=User)(objectClass=userProxy))(objectSid=S-1-5-21-1061109567-1712144220-1378238271-319))
  </code></pre>
  
  <p>the search result is empty. However, there's a clue: examining the result object with the debugger reveals that it has the following properties:</p>
  
  <pre><code>refEx.handleReferrals = 1
  refEx.nextReferralEx = LdapReferralException: Continuation Reference ...
  refEx.nextReferals.referrals[0] = ldap://DomainDnsZones.AD2012.local/DC=DomainDnsZones,DC=AD2012,DC=local
  </code></pre>
  
  <p>Here's the question: why does the server not follow the referrals in the second - by the SID - search? I know it does in the first as the search fails if I remove the "follow" environment property.
  Any input is greatly appreciated.</p>