Opinion - AD Object Identity Attribute

[Yevrag35]

I'm curious about anyone's opinion on how (or if) I should implement the "ID" in the API path.

Normally in a REST api, you'd have endpoints that accept an ID to act on a particular entity. E.g. -
/customers/{id}

At first, I wanted to do this here for AD as well, but each attribute candidate that I think of, I have reservations about.

• distinguishedName

  • The obvious choice as the LDAP libraries need this to do most operations against a single object. But this is lengthy and it's possible that certain DNs would require URL encoding.

• the rest of the attribute options below all have the downside that an AD search query must be performed prior to acting on the object.

• objectGUID

  • Pro is that is guaranteed to be unique and its format is standard.

• objectSID

  • Most will be longer than objectGUID but still fairly standard. Can code things into the API that restricts actions to the built-in SIDs. Because SIDs have a domain component to them, it would negate the need for specifying domains when the API has multiple registered.

Are there any other attribute candidates that anyone can think of?