Azure SSO - sAMAccountName instead of email

[howartp]

With all the moves to MFA i'm presuming many of you will be ahead of me in this game and wondering if you can help.

 

We've just synced to Azure and i'm starting to setup the SAML applications for staff to auth against.

 

We use SchoolCloud Room Booking System which our ADFS sends sAMAccountName (J.Bloggs) but when following their Azure guide, Azure is sending userprincipalname aka the email address ([email protected]) so it's creating new users in the room bookings.

 

Does anyone know how to change Azure to send sAMAccountName? I've tried editing the NameID to send user.onpremisesamaccountname but it doesn't seem to be making any difference - am I in the right area?

[Steve21]

How are you getting up SSO? If it's via SAML etc you can modify the attributes in each link (I'm assuming you have a link for Room Booking?) in the enterprise app, and just change it to what you want to link to

 

Example below:

 

Are you sure you didn't miss a bit though as we use the email/UPN rather than sAMAccountName unless you mean that back to front, where you have sAMAccountName set in SAML/SSO and not in Room Booking?

 

Or do you have existing users you don't want to change?

 

Steve

[howartp]

Or do you have existing users you don't want to change?

This.

 

Our local ADFS server sent ID as sAMAccountName, so that’s what our users are on RBS.

 

I spoke to RBS this afternoon and they’ve ‘solved’ the problem by mass-updating our user IDs to emails, which has worked, but that doesn’t help me long term as I add other apps to Azure and try and learn how to change the nameID being sent.

 

(I was in the area on your screenshot, editing the default nameID rather than any of the data attributes, but nothing seemed to update)

 

Peter

[Steve21]

It's the Unique part that matches, but we haven't used ADFS in years, this is pure Azure SSO so guessing you might need to do something on your end in that regards.

 

So we can just change the unique match depending on what application requires what under a new enterprise app for each one

 

Steve

[chaplic]

You were along the right lines though some of the special attributes are a bit fussy, I think onpremisessamaccountname should be fine. Assuming onpremisessamaccountname is actually populated.

 

To diagnose fully I’d use a browser plugin like samlspy to see what nameid AAD is passing to the end app via the browser