I configured a AD FS 3.0 server an proxy and federated this with Office 365. The active directory domain name is domain.local, the users email address is domain-plus.be. It's not an option to change the users UPN so I chose to configure the alternative login ID for Office 365. I also changed the Microsoft Office 365 Identity Platform claim following this post. That way users would be able to login to adfs with there email address user@domain-plus.be without changing the upn.
Now i'm experiencing the following situation:
- When I login to a domain joined computer and add the AD FS signin page URL in the internet sites of the user. The user navigates to https://portal.office.com, enters his emails address and is redirected and automatically logged on to the Office 365 portal. No password is requested, as it should be.
- When I use the same domain joined computer and use Chrome instead of IE, i'm redirected to the AD FS signin page after entering the email address on https://portal.office.com. But when I enter the password in there I get the following error in the AD FS logs:
Protocol Name: wsfed Relying Party: urn:federation:MicrosoftOnline Exception details: Microsoft.IdentityServer.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. ---> Microsoft.IdentityServer.Service.AccountPolicy.ADAccountLookupException: MSIS8013: CanonicalName:'' of the user:'CN=Testmailmigration,OU=Users,OU=Bio,DC=BIO,DC=local' is in bad format. The user is still the same user that was logged on to the Office 365 portal minutes ago. There users are working internally so the AD FS proxy is not used.
- When I try to login external I experience the same issues as the 2nd scenario.
The username and password are correct, that we can conclude from scenario 1. Does someone also experienced this error when configuring a simular setup?
Thanks in advance, Gijs.