mS-DS-ConsistencyGuid attribute support

Version Affected:  All

Description:  

Which versions of SecureAuth IdP support mS-DS-ConsistencyGuid.

Cause:  

A migration to Office365 or merge into an existing Org may require that mS-DS-ConsistencyGuid  is used instead of objectGUID for the sourceAnchor.

Both objectGUID and mS-DS-ConsistencyGuid are stored in Active Directory as an array of 16 bytes.  When objectGUID is returned via LDAP it is automatically translated into a String value containing the GUID as text by Active Directory, however this does not happen for mS-DS-ConsistencyGuid so the raw byte array is returned instead.

In older versions of IdP the raw byte array cannot be read by SecureAuth IdP correctly and if attempts are made to add it to a SAML assertion the result looks garbled and may contain unprintable characters.

Resolution:  

The below versions of IdP can correctly read and translate the mS-DS-ConsistencyGuid attribute into a string value.

Version 19.07 and higher of SecureAuth IdP already have support for mS-DS-ConsistencyGuid included from initial release.

IdP versions 9.1 to 9.3 also have support for mS-DS-ConsistencyGuid from the following hotfix versions:

9.1.0-54
9.2.0-30
9.3.0-11

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.