juicedata/juicefs · error

invalid uid %d for sid %s

Error message

invalid uid %d for sid %s

What it means

ConvertSidStrToUid converts a SID string to a POSIX UID via convertSidToUid. If the conversion returns a negative value (SID nil/invalid, no matching POSIX offset, or the computed UID is out of range), the function returns -1 wrapped in this error naming both the invalid UID and the input SID string. Callers cannot map that SID to a valid UID.

Source

Thrown at pkg/win/sid.go:324

			NetbiosDomainName: dom.NetbiosDomainName,
			DnsDomainName:     dom.DnsDomainName,
			TrustPosixOffset:  0,
		})
	}

	if len(trustedDomains) != 0 {
		initializeTrustPosixOffsets()
	}
}

func ConvertSidStrToUid(sidStr string) (int, error) {
	sid, err := windows.StringToSid(sidStr)
	if err != nil {
		return -1, err
	}
	ret := convertSidToUid(sid)
	if ret < 0 {
		return -1, fmt.Errorf("invalid uid %d for sid %s", ret, sidStr)
	}
	return ret, nil
}

func convertSidToUid(sid *windows.SID) int {
	if sid == nil || !sid.IsValid() {
		return -1
	}

	subAuthCount := sid.SubAuthorityCount()
	if subAuthCount == 0 {
		return -1
	}

	// SID FORMAT: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
	// S-VERSION-IDENTIFIER_AUTHORITY-SUBAUTHORITY1-SUBAUTHORITY2-...-SUBAUTHORITYn(RID)
	// SUBAUTHORITY1-SUBAUTHORITY2 also known as Domain Identifier

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Validate the SID string and check sid.IsValid() semantics before conversion; malformed input should be rejected earlier.
2. Confirm the SID's domain has a trustPosixOffset object in AD (LdapGetTrustPosixOffset path); add one if missing.
3. Only map domain SIDs (S-1-5-21-*) with UID-range rules; skip well-known/local/service SIDs.
4. Log the SID and returned uid to determine which negative branch of convertSidToUid fired and fix that case.

Example fix

// before
uid, err := win.ConvertSidStrToUid(sidStr)
// after
if !strings.HasPrefix(sidStr, "S-1-5-21-") {
    return 0, fmt.Errorf("SID %s has no POSIX mapping", sidStr)
}
uid, err := win.ConvertSidStrToUid(sidStr)
if err != nil {
    return 0, fmt.Errorf("map sid %s: %w", sidStr, err)
}

// Go: pre-check SID shape before conversion
func isMappableDomainSid(sidStr string) bool {
    return strings.HasPrefix(sidStr, "S-1-5-21-") && strings.Count(sidStr, "-") == 7
}

func validSidStr(s string) bool {
    _, err := windows.StringToSid(s)
    return err == nil && strings.HasPrefix(s, "S-1-5-")
}

uid, err := ConvertSidStrToUid(sidStr)
if err != nil {
    log.Printf("no POSIX uid for %s: %v; falling back to nobody", sidStr, err)
    uid = -1
}

When it happens

Trigger: Calling ConvertSidStrToUid(sidStr) when the SID string parses but windows.StringToSid/convertSidToUid yields ret < 0: SID is malformed or invalid, or no trustPosixOffset rule covers the SID's domain, or the RID-based UID overflows/underflows the valid range.

Common situations: Translating SIDs from local accounts, service SIDs (e.g. S-1-5-80-*), or well-known SIDs (S-1-5-18, S-1-1-0) that have no AD POSIX offset; the domain was never assigned a trustPosixOffset; passing a SID from a foreign/untrusted forest.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• printsid command is only supported on Windows
• failed to run command line: %s, %v
• failed to find command line for pid: %d
• cannot find command line for pid %d. If the juicefs are moun
• failed to exec command line: %s, %s

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/e766dc217778bb44. Report an issue: GitHub.