RSA Authentication Agent 1.0.1 for Active Directory Federation Services (AD FS) sends domain\samAccountName instead of UPN to Authentication Manager

[#1]

Article Number

000035109

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for Active Directory Federation Services (AD FS) 
RSA Version/Condition: 1.0.1
 

Issue

1. At the AD FS front end web page the customer enters their UPN such as jon.smith@company.com in the User Name field, along with their password.  

Image description

2. But ADFS prompts for a passcode with samAccountName, prefixed with the domain; for example, company\jon.smith instead.

 

Image description

3. Since the user ID is in UPN format in Authentication Manager, the Domain\samAccountname format of the same user is not found, so logon fails with failure to resolve User ID or Alias.

Cause

Since Microsoft AD FS owns the format of the username displayed (that is, <domain>\jon.smith, the Authentication Agent for AD FS needs to alter the AD FS behavior through a GPO. However, this GPO must be in place before the agent is registered with both AD FS and with Authentication  Manager.

The SecurIDAuthProvider(MicrosoftIdentityServer...).log for the AD FS agent will show the claim type, in this case windowsaccountname, when it should be UPN.
 

Image description

Resolution

In this situation you will need to unregister the agent with AD FS, then reregister it after the GPO is in place.

1. The ADFSUnregisterationSample PowerShell script should be in  C:\Program Files\RSA\RSA Authentication Agent\AD FS Adapter\SampleRegistrationScripts.

Image description

2. In PowerShell change directory to the  ..\AD FS Adapter\SampleRegistrationScripts directory and run the ADFSUnregistrationSample.ps1 (or your customized) PowerShell script

Image description

3. Follow this by running the ADFSRegistrationSample.ps1 (or your customized) PowerShell script
4. If AD FS is running in a farm of AD FS servers, the (un)registration commands are run on any server, but then the AD FS service needs to be restarted ON EACH SERVER afterwards.

Be sure to close IE to clear the browser cache before trying after this fix.

5. The SecurIDAuthProvider(MicrosoftIdentityServer...).log for the AD FS agent should now show the claim type to be UPN:

Image description

Workaround

A workaround would be to use an alias for the samAccountName in Authentication Manager for the UPN user name.

Notes

Also, the display will not change.  The value of company\jon.smith will still show, but the Authentication Manager logs, including the Authentication Activity Monitor, will show the UPN jon.smith@company.com.