Is there a way to accept both SAMAccountName AND UserPrincipalName for user authentication?

Will_Baldwin — Fri, 14 Oct 2022 15:56:37 GMT

Bottom line I would like my user to be able to authenticate using either "MyUserID" or "MyUserID@MyDomain.com". Can this be done?

Right now, my users authenticate using their SAMAccountName/userID. As we move toward x.509 Personal Certificate authentication, the user certs provide a UPN (email address). Given a user who has a SAMAccountName of "MyUserID" and UserPrincipalName of "MyUserID@MyDomain.COM"; is there a way to setup Authentication Profiles to strip off the "@mydomain.com" and thus always send the radius server just "MyUserID" for account matching?

I've been looking at Authentication Profile -> Username Modifier but I don't yet see a way to accomplish what I am looking for.

Any suggestions?

Re: Is there a way to accept both SAMAccountName AND UserPrincipalName for user authentication?

dmifsud — Sat, 15 Oct 2022 21:10:45 GMT

I think you were looking in the right place, the username modifier is explained here and seems to be what you want:

Authentication Profile (paloaltonetworks.com)

If you specify the %USERDOMAIN% variable and leave the User Domain blank, the firewall removes any user-entered domain string.

- DM

topic Is there a way to accept both SAMAccountName AND UserPrincipalName for user authentication? in GlobalProtect Discussions

Is there a way to accept both SAMAccountName AND UserPrincipalName for user authentication?

Re: Is there a way to accept both SAMAccountName AND UserPrincipalName for user authentication?