An Active Directory user account is an entry with the user object class, which builds on the more generic LDAP object classes covered in Entries and attributes.
top
└── person
└── organizationalPerson
└── user
Each level adds attributes: person contributes cn and sn; organizationalPerson adds things like title and telephoneNumber; user adds AD-specific attributes like sAMAccountName and userAccountControl.
| Attribute | Meaning |
|---|---|
sAMAccountName | Legacy short logon name (max 20 characters, must be unique in the domain) |
userPrincipalName | Modern logon name, shaped like an email address |
distinguishedName | The user's full DN |
objectGUID | A permanent, unique binary identifier that never changes, even if the user is renamed or moved |
objectSid | The security identifier used in access tokens and permissions |
cn | Common name — typically the display name, and part of the RDN |
Note
objectGUID is the right identifier to use as a stable foreign key in your own database. Unlike a DN, it doesn't change if the user's entry is renamed or moved to a different OU.
dn: CN=Jane Doe,OU=Engineering,OU=Users,DC=corp,DC=example,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Jane Doe
sn: Doe
givenName: Jane
sAMAccountName: jdoe
userPrincipalName: jdoe@corp.example.com
mail: jane.doe@example.com
memberOf: CN=Engineering,OU=Groups,DC=corp,DC=example,DC=com
userAccountControl: 512
userAccountControl: 512 means a normal, enabled account — see Common attributes for what other values of that bitmask mean.
const filter = `(sAMAccountName=${escapeFilterValue(username)})`;
See Active Directory integration in Node.js for the full search code, and Common attributes for a broader reference table.
Continue to Groups for how AD models group membership and nesting.