os/user: Lookup() method returns incorrect user type when NT4 users are migrated to Active Directory

[satya-prasad-chellu]

Go version

go version go1.20 windows/amd64

Output of go env in your module/workspace:

set GO111MODULE=off
set GOARCH=amd64
set GOBIN=
set GOCACHE=****
set GOENV=****
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=****
set GONOPROXY=https://github.com/golang/go.git
set GONOSUMDB=https://github.com/golang/go.git
set GOOS=windows
set GOPATH=****
set GOPRIVATE=https://github.com/golang/go.git
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=****
set GOVCS=
set GOVERSION=go1.20
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=0
set GOMOD=
set GOWORK=
set CGO_CFLAGS=-O2 -g
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-O2 -g
set CGO_FFLAGS=-O2 -g
set CGO_LDFLAGS=-O2 -g
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=****

What did you do?

When users from deprecated NT4 Domain controller are migrated to the new Active Directory, the method Lookup from os/user used to identify the type of user returns incorrect type.

What did you see happen?

The returned type of user is SidTypeGroup

What did you expect to see?

The expected type is SidTypeDomain.

[bcmills]

(attn @golang/windows)

[dagood]

This caught my eye because I've done a little investigation into a problem with AAD: #26041. Probably not related, but a fix might mean changing the logic a decent amount so figured I should get set up to try things with AD as well.

the method Lookup from os/user used to identify the type of user returns incorrect type.

Can you provide a code example? I don't see a direct way to get the type of user from that call and want to make sure I'm not looking in the wrong place.

[satya-prasad-chellu]

@dagood Thank you for the response!

Code is very generic as below:

import (
...
"os/user"
..
)

func CheckAdUser(username string) {
usr, err : = user.Lookup(username)
if err != nil {
fmt.Println("Lookup failed with Error: %s", err)
}
}

//input username: username@domain
//output lookup user username@domain Error lookupUserPrimaryGroup: should be domain account type, not 2

[dagood]

Error lookupUserPrimaryGroup: should be domain account type, not 2

I see, so this is why you mentioned SidTypeGroup (2) and SidTypeDomain.

go/src/os/user/lookup_windows.go

Lines 238 to 245 in 2f6a25f

	func lookupUserPrimaryGroup(username, domain string) (string, error) {
	// get the domain RID
	sid, _, t, e := syscall.LookupSID("", domain)
	if e != nil {
	return "", e
	}
	if t != syscall.SidTypeDomain {
	return "", fmt.Errorf("lookupUserPrimaryGroup: should be domain account type, not %d", t)

It seems the primary group of username is a group rather than the domain? I messed around with "Set Primary Group" in AD and wasn't able to make this error show up. However, I wasn't able to make my new primary group choice show up anywhere, so I may have done it wrong. I'm not sure what else might influence this.

Are you able to compare this user vs. one that's working (a user added post-migration?) to try to find any differences that might explain this?

You can also try running this with domain to get more information about what's being found inside Lookup:

func domainLookup(domain string) error {
	sid, domainOut, accType, err := syscall.LookupSID("", domain)
	if err != nil {
		return err
	}
	sidString, err := sid.String()
	if err != nil {
		return err
	}
	fmt.Printf("sid: %v, domain: %v, accType: %v\n", sidString, domainOut, accType)
	return nil
}

[satya-prasad-chellu]

@dagood apologize to come back after a long with the information.
The primary group of username is 'domain user' which is a sub-domain.

[satya-prasad-chellu]

@dagood The issue is with the user from one domain say domain1 which is part of group of another domain say domain2 logging to the workstation joined to domain2.

Also, as you mentioned, we have to lookup for domain, but here our application is not aware of domain as it gets username in the form of usrename@ and this suffix is not a domain:

func domainLookup(domain string) error {
sid, domainOut, accType, err := syscall.LookupSID("", domain)
if err != nil {
return err
}
sidString, err := sid.String()
if err != nil {
return err
}
fmt.Printf("sid: %v, domain: %v, accType: %v\n", sidString, domainOut, accType)
return nil
}