Authenticating with samAccountName in UPN format

Question

While adding support for authenticating a user via Active Directory using the user's samAccountName, I accidentally authenticated with the samAccountName in UPN format.

Example: User has UPN of [email protected] the samAccountName is anotherTest Note that the samAccountName and the UPN are completely different. When I perform the ldap bind operation with username as [email protected], the authentication surprisingly succeeds.

Why does it succeed? Is it valid to bind with a samAccountName in UPN format?

Thanks

Answer 1

Good question. This has been the case and I have never tried to find an answer. I couldn't find a document online but just this discussion in another forum.

It sounds like there is a default UPN in Active Directory (but not ADAM) regardless of what value you set in the userPrincipalName attribute. The default UPN is in the form of <samAccountName>@<domainName>.

You should also note that userPrincipalName attribute is not a mandatory attribute. That means you can always create an AD user object with no value assigned to userPrincipalName attribute. You won't realize that if you are creating it using Active Directory User and Computer snapin because the UI itself forces you always type in the value. However, if you create an AD object programmatically using ADSI, you are allowed to do that.

If you are old enough to have some experience on NT4 system, you should be aware that there was only samAccountName at that time but no UPN at all. Exactly because of this, when you do the migration from NT4 to Windows 2003, you will create a bunch of users with no UPN set to it

I suspect this was the motivation to have a default UPN derived from samAccountName.

Note that samAccountName is a mandatory attribute for AD user object. So, there is no chance that this attribute is empty.