title: Resolving ForeignSecurityPrincipals in Active Directory with UnboundID LDAP SDK for Java
body: <p>I am trying to resolve <em>ForeignSecurityPrincipals</em> to <em>User</em> objects in an Active Directory Server network using <strong><em>exclusively</em></strong> the LDAP Interface via the UnboundID LDAP SDK for Java (<a href="https://www.ldap.com/unboundid-ldap-sdk-for-java" rel="nofollow">https://www.ldap.com/unboundid-ldap-sdk-for-java</a>).</p>
  
  <p>What I am trying to do is the following:</p>
  
  <ul>
  <li>Import a Group </li>
  <li>Import all users in that Groups
  <ul>
  <li>Resolve all ForeignSecurityPrincipals contained as members</li>
  </ul></li>
  </ul>
  
  <p>Importing the group is easily done, but the group contains some <em>ForeignSecurityPrincipals</em> as members. These first have to be resolved to "real" <em>User</em> objects using the principals <em>objectSID</em>. </p>
  
  <p>As far as I understand, the <em>ForeignSecurityPrincipal</em> points to another object resident on a different server, which has to be resolved. According to the guide here (<a href="https://community.oracle.com/message/4697183#4697183" rel="nofollow">https://community.oracle.com/message/4697183#4697183</a>) I should be collecting all trust parents and then iterate over them to search for the <em>User</em> object. Unfortunately in our case, this doesn't result in any users being found. </p>
  
  <p>Because of additional information I have, I know in which server the specific user I am using for testing is resident in, but I can not even find that server in the trust parent list of my original server. I am accessing my server as a global Catalog, therefor, as far as I understand, I should be able to find everything resident on the entire network. Correct?</p>
  
  <p>Note that the group and the user referenced by the principal are resident in two completely distinct trees, not subtrees of each other. (e.g. the group is in the foo.com domain and the user in the acme.net domain).</p>
  
  <p>Does anyone have experience with the lookup of <em>ForeignSecurityPrincipals</em> in Active Directory and can provide any guidance as to which step I might be missing or which problems I might be overlooking?</p>
  
  <p>Thanks!</p>