Why can a user log in via more than one UPN?

Question

I've changed the for all users UPN suffix of a company from us.mycompany.local to mycompany.com in order to use claims-aware applications. In testing before the change I discovered that even if I changed the UPN suffix, a user could successfully authenticate using the old suffix. What I don't understand is why this still works.

Answer 1

Ryan and Joe's comments above are on target. It sounds like your users are logging in with their Implicit UPNs. Is your domain's FQDN us.mycompany.local?

In Active Directory, each user has two UPN's:

1. Explicit UPN (eUPN): This is the value of the user object's userPrincipalName attribute. This can be changed to any value, regardless of any alternate UPN suffixes you have configured in the forest.

2. Implicit UPN (iUPN): This is constructed by concatenating the value of the user object's samAccountName attribute with the value of the domain's FQDN. The FQDN is stored as the value of the dnsRoot attribute of the domain's crossRef object stored at LDAP://CN=DOMAIN_NETBIOS_NAME,CN=Partitions,CN=Configuration,DC=DOMAIN)

Jorge de Almeida Pinto, a DS MVP, has a series of posts that go into much more detail:

• https://jorgequestforknowledge.wordpress.com/2010/10/12/user-principal-names-in-ad-part-1
• https://jorgequestforknowledge.wordpress.com/2010/10/12/user-principal-names-in-ad-part-2
• https://jorgequestforknowledge.wordpress.com/2010/10/12/user-principal-names-in-ad-part-3

EDIT 1:

It's also worth noting that the eUPN "wins" if there is a conflict. For example, consider the following (albeit ridiculous) scenario:

• Domain name: example.com
• User1's samAccountName: user1
• User2's userPrincipalName (eUPN): user1@example.com

If you attempt to login using the username user1@example.com, you will be logged in as User2. However, if you change User2's userPrincipalName to anything else, you would be signed in as User1.

EDIT 2:

More info per MS: MSKB929272: Interactive logon styles and Key Distribution Center account lookup in Windows Server 2003

Answer 2

It could be one of two things:

1. The new UPN is added as an alternative UPN, and the original still stands.
2. The old UPN is added as Domain name (pre-Windows 2000), and will be functional

Go to Active Directory Domains and Trusts and check the UPN(s) and the pre-windows setting.