How To: Use Domain\Username Format for RADIUS Login – SecureAuth Support

Version Affected: RADIUS 2.2+ and all IdP versions

Overview

By default, RADIUS does not recognize a login entered in Domain\Username format. This article explains how to configure the realm and the RADIUS server so that users can log in with Domain\Username, which RADIUS then converts to User Principal Name (UPN) format.

Enable Domain\Username Format for RADIUS Login

On the realm, under the Data tab, set Datastore Type to Active Directory (UPN).

Membership Connection Settings section, with Datastore Type set to Active Directory (UPN).

On that same realm, enable the API and generate an Application ID and Application Key for it.

Realm API Key settings, with Enable API for this realm checked and API Credentials generated, showing an Application ID and Application Key.

On the RADIUS server, edit that IdP realm entry and paste the same Application ID and Application Key into it.

RADIUS server's Edit IdP Realm page, with the API Application ID and API Application Key fields filled in (masked).

On the RADIUS server, create (or edit, if it already exists) C:\idpRADIUS\bin\conf\domainUPNSuffixes.properties. Open Notepad as Administrator to create this file if it does not already exist.
Add one line per domain that needs to be recognized, mapping the short domain name to its UPN suffix, for example:

<short_domain_1>=<short_domain_1>.<full_domain_suffix_1>
<short_domain_2>=<short_domain_2>.<full_domain_suffix_2>

For example, for a domain with the short name contoso and the UPN suffix contoso.local, add the line contoso=contoso.local.

Save the file.

Once these changes are in place, when a user enters their login in Domain\Username format, the RADIUS server automatically converts it to UPN format before authenticating, and the client integrated with RADIUS accepts the Domain\Username format.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.