title: Should I authorize users based on their SID or their Windows Username?
body: <p>I am creating a C# DotNet Application that authorizes users using their <strong>windows active directory ID</strong>.</p>
  <p>Windows users have 2 unique identifiers</p>
  <ul>
  <li>The Username <strong>(e.g. MyDomain\someuser)</strong></li>
  <li>The SID <strong>(e.g. S-1-5-21-1695517229-881958489-217698969-1001</strong></li>
  </ul>
  <p><strong>QUESTION:</strong> In my back end should I authorize users based on their <strong>SID</strong> or <strong>Windows Username</strong>?</p>
  <p>What's the best practice?</p>
  <p><strong>Here are my thought so far:</strong></p>
  <ul>
  <li>The SIDs are unique but some newbie can delete and create a new Active Directory ID. This will cause the user to have different SID and unable to login</li>
  <li>As for the username, I'm worried it can be spoofed. Not sure if such is possible though.</li>
  </ul>