ADFS requires appending domain name to username

joym8 86 Reputation points
2020-08-18T22:01:40.367+00:00

Currently the way our ADFS 4.0 on Windows 2019 datacenter is set up, users need to add @keyman .company.com to their username to be able to log in successfully.

We added (what I feel is a bandaid solution) a JavaScript that appends that qualifier so that user does not have to do this.

We have only one domain.

  1. Is there any way we can configure ADFS to eliminate the need for doing this?
  2. If it is not possible, how can we configure the JavaScript to add the @keyman qualifier on the password expired page as well?
Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,240 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Mark E 76 Reputation points
    2020-08-18T23:13:16.217+00:00
    0 comments
  2. Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee
    2020-08-19T13:46:15.887+00:00

    User can either type their username in the DOMAIN\Samaccountname format or the UPN format (the username@dnsdomainname). Or like Mark suggested, you can configure a custom attribute (although that custom attribute also need a something@something format).
    The official way to have the user typing only one part is to go the JavaScript way. It's probably what you've done and it is described here. For the password update page, you can do the same thing. There is an example here.

    You can also achieve SSO without having to prompt the user for anything. Like using certificates. Or if you are using ADFS for Azure AD integration (to use Office 365 for example), you can have SSO thanks to having a PRT on an AAD Joined Windows 10 or Hybrid AAD Joined Windows 10. Then you won't see a form. But if you are using ADFS for Azure AD, maybe you should reconsider using ADFS all together and use Azure AD Connect Seamless Sign-On instead.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.