000035109 - RSA Authentication Agent 1.0.1 for Active Directory Federation Services (AD FS) sends domain\samAccountName instead of UPN to Authentication Manager

Document created by RSA Customer Support Employee on May 14, 2018Last modified by RSA Customer Support Employee on Jun 28, 2019
Version 5Show Document
  • View in full screen mode

Article Content

Article Number000035109
Applies ToRSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for Active Directory Federation Services (AD FS) 
RSA Version/Condition: 1.0.1
  1. At the AD FS front end web page the customer enters their UPN such as jon.smith@company.com in the User Name field, along with their password.  


  1. But ADFS prompts for a passcode with samAccountName, prefixed with the domain; for example, company\jon.smith instead.


  1. Since the user ID is in UPN format in Authentication Manager, the Domain\samAccountname format of the same user is not found, so logon fails with failure to resolve User ID or Alias.
CauseSince Microsoft AD FS owns the format of the username displayed (that is, <domain>\jon.smith, the Authentication Agent for AD FS needs to alter the AD FS behavior through a GPO. However, this GPO must be in place before the agent is registered with both AD FS and with Authentication  Manager.

The SecurIDAuthProvider(MicrosoftIdentityServer...).log for the AD FS agent will show the claim type, in this case windowsaccountname, when it should be UPN.
User-added image
ResolutionIn this situation you will need to unregister the agent with AD FS, then reregister it after the GPO is in place.
  1. The ADFSUnregisterationSample PowerShell script should be in  C:\Program Files\RSA\RSA Authentication Agent\AD FS Adapter\SampleRegistrationScripts.

Sample ADFS PS scripts

  1. In PowerShell change directory to the  ..\AD FS Adapter\SampleRegistrationScripts directory and run the ADFSUnregistrationSample.ps1 (or your customized) PowerShell script


  1. Follow this by running the ADFSRegistrationSample.ps1 (or your customized) PowerShell script
  2. If AD FS is running in a farm of AD FS servers, the (un)registration commands are run on any server, but then the AD FS service needs to be restarted ON EACH SERVER afterwards.

Be sure to close IE to clear the browser cache before trying after this fix.

  1. The SecurIDAuthProvider(MicrosoftIdentityServer...).log for the AD FS agent should now show the claim type to be UPN:

WorkaroundA workaround would be to use an alias for the samAccountName in Authentication Manager for the UPN user name.
NotesAlso, the display will not change.  The value of company\jon.smith will still show, but the Authentication Manager logs, including the Authentication Activity Monitor, will show the UPN jon.smith@company.com.