<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I think your application admin is confusing the CN attribute with the samAccountName (pre-Windows 2000) attribute.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The CN value, when used as the RDN, is only unique within a given OU. The samAccountName attribute must be unique within a single domain and the userPrincipalName (UPN) must be unique in the forest.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
When you create a new Group and type a name in the "Group name", aka CN, field, it copies the text to the "Group name (pre-Windows 2000)", aka samAccountName, field as well. You can't duplicate the samAccountName, so you must edit that field, but you don't
have to change the "Group name" field if the new group is in a different OU.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Since they don't know any better, it's good that you are only mapping from the app's OU!</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of IAM David Bantz via users <users@shibboleth.net><br>
<b>Sent:</b> Friday, April 8, 2022 5:12 PM<br>
<b>To:</b> Cantor, Scott <cantor.2@osu.edu><br>
<b>Cc:</b> IAM David Bantz <dabantz@alaska.edu>; Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: releasing AD group names</font>
<div> </div>
</div>
<div>
<p><span style="color:#D73F09">[This email originated from outside of OSU. Use caution with links and attachments.]</span></p>
<div>
<div dir="ltr"><br>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On 08Apr2022 at 14:29:21, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" type="cite" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div>
<div>
<blockquote type="cite">Is this a common requirement?<br>
</blockquote>
<br>
It's not safe, those names aren't unique. Consider two groups called CN=admin but with different OUs. Obvious problem there in the event if a mistake in configuration somewhere.<br>
</div>
</div>
</blockquote>
<br>
</div>
<div class="x_gmail_quote" dir="ltr">I made exactly that argument to the application admin, and provided a similar example. The claim back is that AD enforces global uniqueness on the CN of groups. An attempt to create just such a competing group with same
CN in a different OU was denied with a message that the name already existed (i.e., in another OU). “AD is not, strictly, and LDAP directory.” A little surprising to me, and I wouldn’t want to stake my app’s security on AD always enforcing that uniqueness,
but the current behavior of AD seems to insulate users against just this unsound practice. I’ll pull the CN’s only from the OU dedicated to that app in any case.</div>
<div class="x_gmail_quote" dir="ltr"><br>
</div>
<div class="x_gmail_quote" dir="ltr">David</div>
</div>
</div>
</div>
</body>
</html>