ADFS logon issue "Your organization could not sign you into the service" 0x80041034

2013-01-23T12:00:20Z

http://support.microsoft.com/kb/2535191

http://social.technet.microsoft.com/wiki/contents/articles/4110.ad-fs-2-0-claims-are-missing-from-the-output-claim-set-after-a-user-s-name-has-changed.aspx

After a user rename in the local Active directory, (the samaccount name, or UPN prefix)
The user is unable to logon the error displayed in a dialog suggests "Your organization could not sign you into the service"
All other users are still able to logon only the users who have recently had there names chnged experience the issue.

Symptoms
•         Federated logon fails for some users. Other users are fine.
•         Embedded HR code is 0x80041034 (PP_E_INVALID_MEMBERNAME The specified member name is either invalid or empty)
•         Samaccountname has changed recently for user
•         Netmon trace on ADFS server(s) at repro shows LDAP query use wrong samacccountname

Cause

LSA cache on AD FS server(s) has stale entries for SID of the user. Therefore SID  Domain\Old_Samaccountname instead of SID  domain\current_samaccountname

The LDAP query performed for claim generation fails to return attributes as it gets not hit when searching by old samaccountname. Thus, ADFS issues an empty token without saml:attributestatement. So OrgID generate 0x80041034 (PP_E_INVALID_MEMBERNAME The specified member name is either invalid or empty)

Resolution

Disable SID cache temporarily using LsaLookupCacheMaxSize as per http://support.microsoft.com/kb/2535191
You could also either
•         reboot ADFS server
•         Change samaccountname back to previous value in AD
•         Use psgetsid.exe from sysinternals to update LSA cache on AD FS server(s)

Technical discussions on Office 365 / for shared services / the domains part of Office 365 / ADFS / Directory sync

2013-01-23T11:51:00Z

First blog

This blog is intended to cover the technologies I support as a Microsoft technical support engineer.

I work in the CTS team for Microsoft in the UK (EMEA), dealing with what we term as shared services (identity) related issues.

Issue relate to ADFS, Logon, Directory Sync, AD to Cloud issues, the areas where the Exchange / Lync / SharePoint teams do not cover.

I hope to blog on common issues I see with my technologies so hope that this information may be of use the anyone running into problems.

Thanks

nigelw

ADFS logon issue "Your organization could not sign you into the service" 0x80041034

Technical discussions on Office 365 / for shared services / the domains part of Office 365 / ADFS / Directory sync