get-openadgroup, get-openadobject etc. identity parameter defaults to distinguishedName

[conroyd-ohsu-edu]

Not sure if I'm missing something here.
I tried the following:

$groupname = "atl-usercategory-itg_employees"
Get-OpenADGroup -Session $session -identity $groupname

and I get a response stating that it can't find the object using a filter that makes use of the distinguishedName property:

Cannot find an object with identity filter: '(&(objectCategory=group)(distinguishedName=atl-usercategory-itg_employees))'

If I change the group name by removing the _employees part at the end, it correctly searches via samAccountName

$groupname = "atl-usercategory-itg"
Get-OpenADGroup -Session $session -identity $groupname

It seems that when there's an underscore in the group name, it incorrectly switches to using distinguishedName.

Is there any way I can force it to use samAccountName, without writing out the ldap filter myself?

[jborean93]

The regex the -Identity parameter uses for the group cmdlet sets a length limit of 20 character for the sAMAccountName.

PSOpenAD/src/PSOpenAD/ADIdentity.cs

Line 109 in 0f7bea2

Match m = Regex.Match(value, @"^(?:[^:*?""<>|\/\\]+\\)?(?<username>[^;:""<>|?,=\*\+\\\(\)]{1,20})$");

Do you find that a manual LDAPFilter with that name works? I wasn’t aware you could have an object with a 20+ characters in this attribute so might have to revisit that logic if need be.

[conroyd-ohsu-edu]

Yeah, the LDAP filter "(&(objectCategory=group)(saMAccountName=atl-usercategory-itg_employees))" works fine.

I read that the saMAccountName limit is extended to 63 characters for groups.

I wonder if a better regex to find distinguished name might be to look for commas and equals signs?

[Denney-tech]

The 20-character limit is for compatibility with older windows clients and AD and specifically for usernames. sAMAccountNames can be up to 256-characters long.

Thus your regex is only valid for user objects.

This is similar to how Windows hostnames are restricted to 15 characters to support NETBIOS, even though AD and DNS allow longer hostnames.

[jborean93]

Thanks for confirming. I’ll do some testing as I swear I tried this when first implementing it but maybe it was just for users.

[jborean93]

I've just removed the length check in the regex pattern which should fix this problem #91.