Troubleshooting: mS-DS-ConsistencyGuid Attribute Returns Garbled Data in a SAML Assertion

Version Affected: All (see Resolution for the specific fixed-in versions)
 
 

Overview

When a realm's Data tab maps the Active Directory (AD) mS-DS-ConsistencyGuid attribute -- for example, as the SourceAnchor for an Office 365 migration or a merge into an existing organization -- older versions of SecureAuth IdP can't read it correctly, and the value included in a SAML assertion looks garbled or contains unprintable characters.

Cause

Both objectGUID and mS-DS-ConsistencyGuid are stored in Active Directory as a 16-byte array. Active Directory automatically translates objectGUID into a readable string value over LDAP, but it does not do this for mS-DS-ConsistencyGuid -- the raw byte array is returned instead. Older versions of SecureAuth IdP can't translate that raw byte array into a string, so any attempt to use it in a SAML assertion produces garbled or unprintable output.

Resolution:

The following versions of SecureAuth IdP can correctly read and translate the mS-DS-ConsistencyGuid attribute into a string value:

• 19.07 and higher -- supported from initial release.
• 9.1.x -- from hotfix 9.1.0-54 and higher.
• 9.2.x -- from hotfix 9.2.0-30 and higher.
• 9.3.x -- from hotfix 9.3.0-11 and higher.

If the realm is on an earlier build than the ones listed above, upgrade or apply the corresponding hotfix before using mS-DS-ConsistencyGuid as the SourceAnchor.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.