Create a Post
Showing results for 
Search instead for 
Did you mean: 

AD UPN Suffix

We have Identity Awareness configured and working with AD Query, Captive Portal (including Kerberos SSO), Terminal Services MuH and RADIUS for Enterprise WiFi (Packet Fence).

We however have problems with user accounts where their Active Directory UPN Suffix was changed as this then no longer matches the domain in the LDAP Account Unit.

What is the official way to configure additional UPN Suffixes?


What we've done so far:

Created additional LDAP Account Units, referencing the same AD servers, credentials and LDAP branch as the one for the AD realm but then unset 'User management' and 'AD Query'.


Problem is that RDS (Terminal Services) MuH agent uses Kerberos to identify users and identifies the person as user@upnsuffix2 but then doesn't resolve group memberships.


The account is technically party of the main/original LDAP Account Unit, is there no way to configure UPN suffix aliases?


adlogconfig a gives an option relating to 'add domain' but I'm unable to locate documentation relating to this...




David Herselman

0 Kudos
2 Replies

@Royi_Priov any idea?

0 Kudos

Hi @David_Herselman 


Generally, I will recommend using Identity Collector and not AD Query

You can read about the differences in sk108235.

In Identity Collector, you also have "alias" feature to replace domain suffixes easily.


I hope it helps!

Royi Priov

Identity Awareness R&D

Royi Priov
Group manager, Identity Awareness R&D
0 Kudos