000035109 - RSA Authentication Agent 1.0.1 for Active Directory Federation Services (AD FS) sends domain\samAccountName instead of UPN to Authentication Manager

Document created by RSA Customer Support Employee on May 14, 2018Last modified by RSA Customer Support Employee on May 14, 2018
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000035109
Applies ToRSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for Active Directory Federation Services (AD FS) 
RSA Version/Condition: 1.0.1
Platform: Windows
 
Issue
  1. At the AD FS front end web page the customer enters their UPN such as jon.smith@company.com in the User Name field, along with their password.  

Logon


  1. But ADFS prompts for a passcode with samAccountName, prefixed with the domain; for example, company\jon.smith instead.
 

Dom


  1. Since the user ID is in UPN format in Authentication Manager, the Domain\samAccountname format of the same user is not found, so logon fails with failure to resolve User ID or Alias.
CauseSince Microsoft AD FS owns the format of the username displayed (that is, domain>\jon.smith, the Authentication Agent for AD FS needs to alter the AD FS behavior through a GPO. However, this GPO must be in place before the agent is registered with both AD FS and with Authentication  Manager.

The SecurIDAuthProvider(MicrosoftIdentityServer...).log for the AD FS agent will show the claim type, in this case windowsaccountname, when it should be UPN.
 
User-added image
ResolutionIn this situation you will need to un-register the agent with AD FS, then re-register it after the GPO is in place.
  1. The ADFSUnregisterationSample PowerShell script should be in  C:\Program Files\RSA\RSA Authentication Agent\AD FS Adapter\SampleRegistrationScripts

Sample ADFS PS scripts


  1. In PowerShell change directory to the  ..\AD FS Adapter\SampleRegistrationScripts directory and run the ADFSUnregistrationSample.ps1 (or your customized) PowerShell script

UnReg


  1. Follow this by running the ADFSRegistrationSample.ps1 (or your customized) PowerShell script
  2. If AD FS is running in a farm of AD FS servers, the (un)registration commands are run on any server, but then the AD FS service needs to be restarted ON EACH SERVER afterwards.

Be sure to close IE to clear the browser cache before trying after this fix.



  1. The SecurIDAuthProvider(MicrosoftIdentityServer...).log for the AD FS agent should now show the claim type to be UPN

ADFS5_ClaimTypeUPN
WorkaroundA workaround would be to use an alias for the samAccountName in Authentication Manager for the UPN user name.
NotesAlso, the display will not change;  company\jon.smith will still show, but the Authentication Manager logs, including the Real Time Monitor Authentication  Activity Monitor, will show the UPN jon.smith@company.com.
 

Attachments

    Outcomes