JNDI and MS Exchange Server 5.5

Question

I was having a bit of grief getting JNDI to talk to the MS Exchange Server for even the most simple things. For example, I could not get the members of a group. As it turns out, Exchange allows the administrator to configure which attributes are visible via LDAP to unauthenticated users.
The member attribute was turned off by default so my code couldn't see it. This is fixed either by using an authenticated connection (which I didn't try) or by setting the attribute to be visible to unauthenticated users. This worked for me. Look at Configuration->DS Site Configuration->Attributes in the Exchange admin tool.
My next problem wasn't as obvious. I wanted to query the value of the "Primary NT Account" associated with a given user. By searching around I found that this field is named "Assoc-NT-Account" when speaking LDAP. Unfortunately, it is not listed in the fields that can be made visible via LDAP as described above. Some more searching yielded this arcane procedure. Use with caution:
1. Run the Exchange admin tool in raw mode:
e.g. c:\exchsrvr\bin\admin.exe /r
2. Select the "View->Raw Dirctory" menu item.
This will make a new folder appear named Schema.
3. Click on the Schema folder to get a list of attributes.
Scroll to "Primary Windows NT Account" and double
click. Click yes to display raw properties.
4. Choose Heuristics from the "Object Attributes" list.
Change the value from 12 to 14. This turns on bit 1.
The bits are (roughly):
Bit 0: Replicate between sites
Bit 1: Attribute visibility through LDAP
Bit 2: Attribute accessibity by authenticated clients
Bit 3: Attribute is an operational attribute
5. Click OK. Now you can retrieve the value of
Assoc-NT-Account.
The last trick is that return value is not in the domain\user form that it is displayed in the Exchange admin tool. Instead it is the NT SID (Security ID) for the user. However, instead of being the normal textual representation of a SID, it is a string representation of the bytes in the raw SID structure. So, to get the standard representation one must convert this string of hexadecimal digits into an array of bytes and interpret it as defined by Microsoft.
If you want the domain and username, you probably need to pass the SID to an NT Domain Controller.

Answer 1

I'm not totally sure about the last part of your message. I thought you were right until I had a look at what a 'real' SID looks like using Evgenii Rudnyi's utilities: user2sid and sid2user, found at http://www.chem.msu.su/~rudnyi/NT/sid.txt
the Assoc-NT-Account I get is:
010500000000000515000000EA35F753FC3DF4122647A33E78140000
and the sid I get using the utility for the exact same "DOMAIN\username" value:
S-1-5-21-1408710122-317996540-1050887974-5240
Those two look slightly different.
I read http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnactdir/html/msdn_adsiexch.asp
and they say Assoc-NT-Account's syntax is a "String(Octet)"
Can anybody help converting this "String(Octet)" to a 'readable' String?
Thanks,
--Benjamin.