ADFS Claim Rule - If UPN with .co.kr domain, then send '.com' domain to Active Directory, Possible?

[Lee chungdu]

Hello, 

1. I'm using Active Directory (on-prem) with abc.com domain, but it's not verified.

2. I already synced with AAD and the AAD has a verified domain(abc.co.kr)

3. UPN from on-prem AD had been synced as '1@abc.co.kr', '2@abc.co.kr' following MOERA policy.

4. Configured ADFS to use O365.

5. When put 1@abc.co.kr to office.com login page, it redirects to ADFS login page(sts.abc.co.kr) and it said 'invalid username or password information' when i put correct credentials for the account.

Environments

Onprem AD (abc.com)

|

ADFS (sts.abc.co.kr)

|

AAD /O365 (abc.co.kr -verified)

Perhaps we might find a solution by setting up an adfs clame rule... can you help me change the input  coming into abc.co.kr to abc.com?

Thank you!

[#2]

I'm not sure I completely understand your scenario, thus I cannot guarantee it will work, but if you need examples on how to manipulate the UPN claim, you can find some in this article: https://blogs.technet.microsoft.com/abizerh/2013/02/05/supportmultipledomain-switch-when-managing-ss...

[#3]

1.  When you enter 1@abc.co.kr it gets directed to ADFS - the domain part here is only used for that.
2. In ADFS you need to use your internal username 1@abc.com because the authentication is performed against your on-premises AD
3. If you haven't configured manually otherwise, ADFS sents userprincipalname 1@abc.com to Office 365. However, this doesn't matter, because Office 365 is using only the ImmutableId attribute to identify users, so no need to change claim issuance rules.

So, if you're having the error in phase 2., just use the 1@abc.com to login.