ADFS authentication with multiple UPNs

[Jason Gauthier]

Greetings,

I have a successful ADFS implementation working with my primary UPN domain (@lastar.com, this email address)
It was brought to my attention today that people (in the same AD domain) with a different UPN suffix cannot access shibboleth protected services.
So, for instance: joe at lastar.com<mailto:joe at lastar.com> hits the web app, goes to shib, off to ADFS, and back again with a username in the apache logs:

192.168.76.144 - - [16/Sep/2013:14:04:33 -0400] "GET /Shibboleth.sso/Login?target=https://site.lastar.com/&entityID=h                                                                      ttp://fs.lastar.com/adfs/services/trust HTTP/1.1" 302 672
192.168.76.144 - - [16/Sep/2013:14:04:34 -0400] "POST /Shibboleth.sso/SAML2/POST HTTP/1.1" 302 238
192.168.76.144 - joe at lastar.com [16/Sep/2013:14:04:34 -0400] "GET / HTTP/1.1" 302 20
192.168.76.144 - - [16/Sep/2013:14:04:34 -0400] "POST /Shibboleth.sso/SAML2/POST HTTP/1.1" 302 238
192.168.76.144 - joe at lastar.com [16/Sep/2013:14:04:34 -0400] "GET / HTTP/1.1" 200 1539

However, joe at anotherupn.com<mailto:joe at anotherupn.com> doesn't work at all:
192.168.76.209 - - [16/Sep/2013:14:04:09 -0400] "GET /Shibboleth.sso/Login?target=https://site.lastar.com/&entityID=h                                                                      ttp://fs.lastar.com/adfs/services/trust HTTP/1.1" 302 677
192.168.76.209 - - [16/Sep/2013:14:04:11 -0400] "POST /Shibboleth.sso/SAML2/POST HTTP/1.1" 302 238
192.168.76.209 - - [16/Sep/2013:14:04:11 -0400] "GET / HTTP/1.1" 200 451

I really don't know what has caused this, as a didn't explicitly indicate anything with '@lastar.com' to succeed, or restrict anything for other ones (I have 5-7) to fail.
Does anyone have a suggestion on how to resolve this?

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130916/5a41e4df/attachment.html