title: ASP.NET - Get the Principal / Relative Identifier (RID) for a DirectoryEntry / SID
body: <p>I am using Active Directory in a custom MembershipProvider class to authenticate users in an ASP.NET 2.0 intranet application and associate their sid with a profile for the application.</p>
  
  <p>When the <code>ActiveDirectoryMembershipProvider</code> is used, the <code>ProviderUserKey</code> object for the <code>MembershipUser</code> is as follows</p>
  
  <pre><code>SecurityIdentifier sid = (SecurityIdentifier)Membership.GetUser().ProviderUserKey;
  string sidValue = sid.ToString();
  
  /* sidValue = "S-1-5-21-XXXX-XXXX-XXXX-YY"  */
  </code></pre>
  
  <p>As I understand it, <code>YY</code> is the principal within the namespace (also referred to as a group/domain).</p>
  
  <p>When using the custom MembershipProvider, I can get the sid using the <code>objectSid</code> property of a DirectoryEntry object</p>
  
  <pre><code>DirectoryEntry entry = new DirectoryEntry(path, username, password);
  SecurityIdentifier sid = new SecurityIdentifier((byte[])entry.Properties["objectSid"].Value, 0);
  string sidValue = sid.ToString();
  
  /* sidValue = "S-1-5-21-XXXX-XXXX-XXXX"  */
  </code></pre>
  
  <p>The <code>sidValue</code> in this case is identical, except it does not contain the principal <code>YY</code>.</p>
  
  <p>My question is two-fold</p>
  
  <ol>
  <li>Is the principal required in order to uniquely identify an individual? </li>
  <li>Is it possible to obtain the principal from the DirectoryEntry object (or through any other classes available in <code>System.DirectoryServices</code>)?</li>
  </ol>
  
  <p><strong>EDIT:</strong></p>
  
  <p>Having done some further reading (<a href="http://www.rlmueller.net/ComputerSIDs.htm" rel="noreferrer">{1}</a> <a href="http://chantilly.computertraining.edu/index.php/guid-vs-sid" rel="noreferrer">{2}</a>), I now know that the sid can change if the user is moved from one group/domain to another. In light of this, would using the <code>GUID</code> defined in the <code>DirectoryEntry</code> <code>Properties["objectGUID"]</code> be a better choice for uniquely identifying a user?</p>