Search code examples
active-directorywindows-authentication

Is there such a thing as a "fully qualified" username within the context of Windows Authentication?


My web-app is hosted on mydomain, with the following URI associated with the domain: blah.net.

I can login to using either of the following usernames:

  • mydomain\ben
  • ben@blah.net

What are the names of each of these types of login (and are there any differences), within the context of Windows Authentication?


Solution

    • ben (in mydomain\ben) is the SAM account name. ("SAM" is short for Security Account Manager, the old Windows NT account system.) I don't know if there is a name for the entire "mydomain\ben" construct.

    • ben@blah.net is called UPN or User Principal Name, where "blah.net" is the UPN suffix.

    • In Active directory there is also something called DN or Distinguished Name or DN which for ben would probably be CN=ben,OU=Users,DC=blah,DC=net. This is the closest to "fully qualified" name I think you get. It describes both the name of the object (the CN part) and the container (OU part) where it resides within the active directory as well as the DNS domain name (DC part) of the Active Directory.

    Of those three, the DN is the ONLY one that can be used to bind directly to the LDAP user object without having any other information. Using the UPN you have to know a domain controller to query. (It is possible to get to the object from the Domain\SamAccountName as well, but it requires first finding the domain controller for Domain and then doing a search for the object with the given SamAccountName).