{"record":{"id":"e766dc217778bb44","repo":"juicedata/juicefs","slug":"invalid-uid-d-for-sid-s","errorCode":null,"errorMessage":"invalid uid %d for sid %s","messagePattern":"invalid uid (.+?) for sid (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/win/sid.go","lineNumber":324,"sourceCode":"\t\t\tNetbiosDomainName: dom.NetbiosDomainName,\n\t\t\tDnsDomainName:     dom.DnsDomainName,\n\t\t\tTrustPosixOffset:  0,\n\t\t})\n\t}\n\n\tif len(trustedDomains) != 0 {\n\t\tinitializeTrustPosixOffsets()\n\t}\n}\n\nfunc ConvertSidStrToUid(sidStr string) (int, error) {\n\tsid, err := windows.StringToSid(sidStr)\n\tif err != nil {\n\t\treturn -1, err\n\t}\n\tret := convertSidToUid(sid)\n\tif ret < 0 {\n\t\treturn -1, fmt.Errorf(\"invalid uid %d for sid %s\", ret, sidStr)\n\t}\n\treturn ret, nil\n}\n\nfunc convertSidToUid(sid *windows.SID) int {\n\tif sid == nil || !sid.IsValid() {\n\t\treturn -1\n\t}\n\n\tsubAuthCount := sid.SubAuthorityCount()\n\tif subAuthCount == 0 {\n\t\treturn -1\n\t}\n\n\t// SID FORMAT: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers\n\t// S-VERSION-IDENTIFIER_AUTHORITY-SUBAUTHORITY1-SUBAUTHORITY2-...-SUBAUTHORITYn(RID)\n\t// SUBAUTHORITY1-SUBAUTHORITY2 also known as Domain Identifier\n","sourceCodeStart":306,"sourceCodeEnd":342,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/win/sid.go#L306-L342","documentation":"ConvertSidStrToUid converts a SID string to a POSIX UID via convertSidToUid. If the conversion returns a negative value (SID nil/invalid, no matching POSIX offset, or the computed UID is out of range), the function returns -1 wrapped in this error naming both the invalid UID and the input SID string. Callers cannot map that SID to a valid UID.","triggerScenarios":"Calling ConvertSidStrToUid(sidStr) when the SID string parses but windows.StringToSid/convertSidToUid yields ret < 0: SID is malformed or invalid, or no trustPosixOffset rule covers the SID's domain, or the RID-based UID overflows/underflows the valid range.","commonSituations":"Translating SIDs from local accounts, service SIDs (e.g. S-1-5-80-*), or well-known SIDs (S-1-5-18, S-1-1-0) that have no AD POSIX offset; the domain was never assigned a trustPosixOffset; passing a SID from a foreign/untrusted forest.","solutions":["Validate the SID string and check sid.IsValid() semantics before conversion; malformed input should be rejected earlier.","Confirm the SID's domain has a trustPosixOffset object in AD (LdapGetTrustPosixOffset path); add one if missing.","Only map domain SIDs (S-1-5-21-*) with UID-range rules; skip well-known/local/service SIDs.","Log the SID and returned uid to determine which negative branch of convertSidToUid fired and fix that case."],"exampleFix":"// before\nuid, err := win.ConvertSidStrToUid(sidStr)\n// after\nif !strings.HasPrefix(sidStr, \"S-1-5-21-\") {\n    return 0, fmt.Errorf(\"SID %s has no POSIX mapping\", sidStr)\n}\nuid, err := win.ConvertSidStrToUid(sidStr)\nif err != nil {\n    return 0, fmt.Errorf(\"map sid %s: %w\", sidStr, err)\n}","handlingStrategy":"validation","validationCode":"// Go: pre-check SID shape before conversion\nfunc isMappableDomainSid(sidStr string) bool {\n    return strings.HasPrefix(sidStr, \"S-1-5-21-\") && strings.Count(sidStr, \"-\") == 7\n}","typeGuard":"func validSidStr(s string) bool {\n    _, err := windows.StringToSid(s)\n    return err == nil && strings.HasPrefix(s, \"S-1-5-\")\n}","tryCatchPattern":"uid, err := ConvertSidStrToUid(sidStr)\nif err != nil {\n    log.Printf(\"no POSIX uid for %s: %v; falling back to nobody\", sidStr, err)\n    uid = -1\n}","preventionTips":["Assign trustPosixOffset objects for every trusted domain.","Filter out well-known/service SIDs before UID mapping.","Log unmapped SIDs for auditing.","Document that only domain SIDs (S-1-5-21-*) are mappable."],"tags":["windows","sid","uid-mapping"],"backgroundTag":"value-out-of-range","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}