Matching DB records to Active Directory entries?

Question

I have been tasked with coming up with a solution where I am not sure if there is a solid answer: How can I match username records from an application's database to users in our Active Directory? I have two applications this needs to be done for - 1st application I only have firstname and lastname information. Second application i have the application's username, which is similar to activeD's but not a definate match. I also have firstname lastname info.

Now, simply put I can just write a script that matches all the records in ActiveD that match the firstname lastname in the application DB, but that is fraught with errors. Having no unique identifier to begin with might make this an impossible task, but before I start to task someone else with manually comparing the data after running the script, I thought I would ask the delightful StackOverflow crew to chew on it. There are always methods I don't think of, after all.

So any brilliant ideas out there to accomplish this task?

Thanks guys

Answer 1

Once you get them matched up automatically and the exceptions by hand, make a custom attribute in Active directory where you can store the information to keep them matched up in the future.

Answer 2

Well, the one thing that will be indeed unique in AD is the sAMAccountName for each user. If you find a way to associate your users in your two databases with a SAM Account Name, you should have no big trouble anymore to do an automatic sync check with AD.

That property is already available in AD, you don't need to add any additional artificial IDs, and it's much easier to read than a GUID.

Marc

Answer 3

You could store the Active Directory object GUID against the database record.