After a user rename in the local Active directory, (the samaccount name, or UPN prefix)The user is unable to logon the error displayed in a dialog suggests "Your organization could not sign you into the service"All other users are still able to logon only the users who have recently had there names chnged experience the issue.
Symptoms• Federated logon fails for some users. Other users are fine. • Embedded HR code is 0x80041034 (PP_E_INVALID_MEMBERNAME The specified member name is either invalid or empty)• Samaccountname has changed recently for user• Netmon trace on ADFS server(s) at repro shows LDAP query use wrong samacccountname
Cause LSA cache on AD FS server(s) has stale entries for SID of the user. Therefore SID Domain\Old_Samaccountname instead of SID domain\current_samaccountname The LDAP query performed for claim generation fails to return attributes as it gets not hit when searching by old samaccountname. Thus, ADFS issues an empty token without saml:attributestatement. So OrgID generate 0x80041034 (PP_E_INVALID_MEMBERNAME The specified member name is either invalid or empty) Resolution Disable SID cache temporarily using LsaLookupCacheMaxSize as per http://support.microsoft.com/kb/2535191 You could also either • reboot ADFS server• Change samaccountname back to previous value in AD• Use psgetsid.exe from sysinternals to update LSA cache on AD FS server(s)