1

LATER EDIT: UserProfile_GUID has nothing to do with objectguid in LDAP. However, it can be used as DN like this dn=<GUID={the_string} when you bind to LDAP. UserProfile_GUID and objectguid are different things

I want to send the current user's UserProfile_GUID to a php script that searches the LDAP server by the objectguid property, giving me the user's name.

The problem is bin2hex(objectguid) in php returns a different value from the UserProfile_GUID that's showing in Sharepoint.

So what format is UserProfile_GUID in Sharepoint? How can I use it to search the LDAP server?

UserProfile_GUID in Sharepoint is something like xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

LATER EDIT: Is there any way I can find some common ID between Sharepoint user propreties and php LDAP? So I can use it to validate the user from Sharepoint to php

  • Hi there, I'm not sure if the UserProfile GUID will match the LDAP object guid you are looking for? Have you checked manually whether passing user profile GUID returns appropriate user name? – Cthulhubutt May 6 '15 at 7:50
  • I am trying but I cannot search the LDAP tree using the UserProgile GUID because it's not in the right format, it's actually a Binding String and I need a hex value – bloomingsmilez May 6 '15 at 8:02
  • I am pretty convinced that the Guid you see in SharePoint isn't related in any way to the actual id the object has on AD. See here for more details, but I would first try to ensure that the id you have at hand actually represent the same info you need to access the AD entry. – Hitodama May 6 '15 at 8:43
  • @SPArchaeologist I found out that the guid given in Sharepoint is actually used as DN at binding, but my AD doesn't allow search when I bind without credentials. So yes, you're right, that string from sharepoint is not useful. – bloomingsmilez May 6 '15 at 8:49
  • So, for future reference, you confirm that the guid in SharePoint isn't actually related to the AD item in anyway? Good to know that those info where right – Hitodama May 6 '15 at 10:10
3

The ObjectGUID is a binary string ( or octet string ), so what you are probably seeing is some random nonsense characters when you attempt display the value.

The ObjectGUID actually follows a well-established standard - it's a UUID version 4. With this information, you should be able to decode the binary string into a readable string representation.

Take a look at this implementation of the conversion in php.

Here's the function in question. It expects the $guid in its original binary form as returned from server.

function _to_p_guid( $guid )
{
$hex_guid = unpack( "H*hex", $guid );
$hex    = $hex_guid["hex"];

$hex1   = substr( $hex, -26, 2 ) . substr( $hex, -28, 2 ) . substr( $hex, -30, 2 ) . substr( $hex, -32, 2 );
$hex2   = substr( $hex, -22, 2 ) . substr( $hex, -24, 2 );
$hex3   = substr( $hex, -18, 2 ) . substr( $hex, -20, 2 );
$hex4   = substr( $hex, -16, 4 );
$hex5   = substr( $hex, -12, 12 );

$guid = $hex1 . "-" . $hex2 . "-" . $hex3 . "-" . $hex4 . "-" . $hex5;

return $guid;
}

  1. Other Approach

All you need to do when retrieving the objectguid is convert it to hex with

$hex_guid = bin2hex($binary_guid);

then to get it into a format to query the active directory there needs to be an escape character every 2 characters like:

4e\7c\70\75\e7\ac\e4\44\af\00\b1\16\28\39\25\7b

here's the function to use:

function FormatGUID($hexGUID){

        $hexGUID = str_replace("-", "", $hexGUID);

        for ($i = 0; $i <= strlen($hexGUID)-2; $i = $i+2){

            $output .=  "\\".substr($hexGUID, $i, 2);
        }

        return $output;
    }

I've not tested this very much yet though, so beware!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.