Nov 22 2018
05:57 AM
- last edited on
Jan 14 2022
04:55 PM
by
TechCommunityAP
Nov 22 2018
05:57 AM
- last edited on
Jan 14 2022
04:55 PM
by
TechCommunityAP
Hi All,
In our development environment we have ADFS 3.0 servers authenticating federated users. Recently, users have been unable to log on using their UPN. SamAaccountName works without issue. For information the domain and upn set up is as follows:
The internal domain is childdomain.root.int.ac.uk
Users exist in the child domain "childdomain.root.int.ac.uk" but have a their UPN changed to username@int.ac.uk.
When signing into Office 365 or via ADFS theya re able to use their samaccountname but using the UPN gives an incorrect username or password error.
We see the following error in the ADFS logs:
Token validation failed.
Additional Data
Token Type:
http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName
%Error message:
If they attempt to use the ADFS password change page I see the following error in the logs:
Password change failed for following user:
Additional Data
User:
u1234560@int.ac.uk.
Device Certificate:
Server on which password change was attempted:
Error details:
UserNotFound
Any ideas what might be causing this?
Nov 22 2018 10:14 AM
You most likely need to adjust the claims rules to pick up the changed UPN format.
Nov 23 2018 05:45 AM
Can you elaborate a little Vasil? The authentication fails completely and claims are not released. The ADFS forms authentication page just rejects the password unless you use the samaccountname format. our production environment is essentially the same and we dont have a similar issue so its quite puzzling.
Nov 23 2018 10:56 AM
Right, seems I've misunderstood the issue then. Your first post listed an "token validation error" event, which is generally generated *after* the user has successfully logon to the AD FS server. If the user is not even able to pass the login prompt, I'd suggest checking the event logs for any 4625/4624 entries related to that user and more specifically looking at the netlogon error ("status") therein.
Jul 02 2019 02:19 PM
Hi David
DId you come right here? I saw something similar many years ago.. You might need to alter the claims to support the multiple UPN suffixes. Did you set up the ADFS with the AADConnect wizard? I'm assuming the new UPN name space is federated and you are using it for Azure/O365
May 20 2020 07:27 AM
Currently we facing the same problem as your, can you share with me how you have fixed?
May 20 2020 07:36 AM
Can your users not login with their UPN's or are you having issues with the Password Reset URL in ADFS?
May 20 2020 07:43 AM
Hi,
The user can not login with their UPN's and gives an incorrect username or password error.
But they are able to logon with SAMAccountname (domain\username) format.
Thanks,
May 20 2020 07:54 AM
Hi
Has this never worked or has it suddenly become a problem? Have you recently changed any users UPN's in the company?
May 20 2020 08:11 AM
It never worked for child2 and no UPN changes
below is our scenario
Parent.com
Child1.parent.com - Child1 was promoted some time ago before we implemented ADFS , both users under parent and child1 are able to logon with same UPN ie. “@abcd.com”
Child2.parent.com -Child2 was just promoted , UPN was configured same as parent and child1 but unfortunately user under Child2 cannot logon with UPN)
PS: We only have one UPN domain
Thanks,
May 20 2020 09:17 AM
So we are talking about 3 Active Directory domains 1 parent and 2 child domains with one UPN namespace stretched across them?
May 20 2020 09:23 AM