Re: ActiveDirectoryMembershipProvider & ValidateUser

It is entirely possible that your company is using implicit
userPrincipalName values instead of expliciting setting them. By default,
if UPN isn't set, then the user will have an implicit UPN of
sAMAccountName@DNSDomainOfTheDomain. This works for authentication, but I'm
not sure you can search for it that way. I wouldn't be surprised if you
can't in this particular case. I actually don't have an AD to play with
right now that uses implicit UPNs, so I'm not sure what the expected query
behavior is.

If you need to use sAMAccountName, make sure you are using the unqualified
version of the name.

In a multi-domain environment, sAMAccountName will be unique to a given
domain, but it won't necessarily be unique across the forest. UPN is
supposed to be unique forest wide, although the DS doesn't actually try to
enforce that like it does with sAMAccountName at the domain level.

I hope that helps some. I wish I knew all the details here.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Craig Wagner" <MSDNNospam207@xxxxxxxxxxxxx> wrote in message
news:F4F22583-2050-4C2C-A48C-2C82E329E641@xxxxxxxxxxxxxxxx
I believe we have multiple domains, but the user I'm trying to authenticate
(me) is in the domain that the provider is configured to access.

I did just discover one interesting thing. I have an Active Directory on
my
home network. I took my proof-of-concept code to my home environment and
ran
it. There I was able to authenticate using user@domain.

What my POC does is authenticates using the
ActiveDirectoryMembershipProvider then uses DirectorySearcher to get
information about a username that was entered. Finally it spits out the
values of all the properties associated with the DirectoryEntry.

On my home environment, one of the properties that shows up in the output
is
userPrincipalName. In my work environment the userPrincipalName is not in
the
property collection.

"Joe Kaplan" wrote:

I doubt that anything in AD needs to change. My guess is that my lack of
detailed knowledge of how the membership provider is designed is the
problem
here.

A few more questions:
- Is the AD in question a single domain forest or are there multiple
domains involved?
- If multiple domains, is the user you are trying to authenticate in a
different domain than what you've configured the provider to access?

I'll try to do some poking around this afternoon to see if I can figure
out
what the likely cause of the problem is.



.

Relevant Pages

  • Duplicate UPNs and "default UPN"
    ... I've been continuing to try to figure out what was going on with a situation that I described in an earlier thread where an LDAP authentication was failing when using the user's name in UPN format: ... As mentioned at the end of the last thread, I was able to create a situation where attempting to authenticate using the user's UPN, as contained in the "userPrincipalName" attribute, would fail, by creating two different users, in two different containers, with both users having their userPrincipalName attribute set to the same value. ... ldifde with a simple bind with that UPN formatted username would then fail, but using a full DN, I could authenticate. ...
    (microsoft.public.windows.server.active_directory)
  • Re: NT domain users missing username@domain entries
    ... This posting is provided "AS IS" with no warranties, ... the explicit UPN COULD BE: ... Implicit UPN: Has the form "username@FQDNDomainName". ... Explicit UPN: Has the form "userIDstring@FQDNstring". ...
    (microsoft.public.windows.server.active_directory)
  • Re: Empty Administrator Username ... ITs possible!!
    ... sAMAccountName or userPrincipalName? ... You can use the UPN if you only set ... the Pre-Windows 2000 name. ...
    (microsoft.public.windows.server.active_directory)
  • Re: How do I connect to active directory?
    ... UPN = userPrincipalName. ... Windows box logged in to the AD domain so that you can take advantage of the ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.active_directory)
  • Re: Unable to bind.
    ... often prevent binds from working. ... You can also use the UPN or displayName as a username for binding if you ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.active_directory)