Having major issues with SSO on Office 365.
A little history.
I originally set up DirSync with AAD using our UPN, which because of a bunch of old Unix apps we use is set to a max of 8 characters. Because of this, our email addresses are different to our UPN's (although the domain is identical). After setting up AAD to use the UPN as the sign on name, SSO back to our ADFS server worked perfectly.
I decided that it would be a better user experience for our staff for this to match their email address, as this would allow users in external companies to search for users in Lync much easier.
The DirSync was changed, and I can see the all users in AAD have had their User Name changed to their email address. I've also followed the instructions to change the ADFS Relying Party Trust rule to point to 'mail' as opposed to 'UserPrincipalName'. I've also run the following command successfully:
Set-AdfsClaimsProviderTrust -TargetIdentifier "AD AUTHORITY" -AlternateLoginID mail -LookupForests <forest domain>
When I run the Microsoft Connectivity Test, it passes successfully with the email address.
However... when I attempt to log on to http://portal.office.com, when the auto redirect attempts to take place after I enter my email address, I am simply returned to back to the Office Portal website.
If I attempt to sign in to Lync with the correct credentials, I get a "Can't sign in, the user name, password or domain appears to be incorrect'. If I attempt to sign in to Lync with an incorrect password (using the email address) I get the below error:
Token validation failed.
Additional Data
Token Type:
http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName
%Error message:
DOMAIN\UPN-The user name or password is incorrect
Exception details:
System.IdentityModel.Tokens.SecurityTokenValidationException: DOMAIN\UPN ---> System.ComponentModel.Win32Exception: The user name or password is incorrect
at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)
at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)
at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUser(UserNameSecurityToken token, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)
at Microsoft.IdentityServer.Service.Tokens.MSISWindowsUserNameSecurityTokenHandler.ValidateTokenInternal(SecurityToken token)
--- End of inner exception stack trace ---
at Microsoft.IdentityServer.Service.Tokens.MSISWindowsUserNameSecurityTokenHandler.ValidateTokenInternal(SecurityToken token)
at Microsoft.IdentityServer.Service.Tokens.MSISWindowsUserNameSecurityTokenHandler.ValidateToken(SecurityToken token)
System.ComponentModel.Win32Exception (0x80004005): The user name or password is incorrect
at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)
at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)
at Microsoft.IdentityServer.Service.Tokens.LsaLogonUserHelper.GetLsaLogonUser(UserNameSecurityToken token, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)
at Microsoft.IdentityServer.Service.Tokens.MSISWindowsUserNameSecurityTokenHandler.ValidateTokenInternal(SecurityToken token)
I have been stuck on this issue for three days now, can ANYONE assist? Apologies if this is long winded (or doesn't have enough info).