A CN (common name) is no good for logging in, because a CN alone does not uniquely identify a user. I could have a
and I could also have a
CN=Ryan Ries,OU=New York,DC=Domain,DC=com
A user's CN is also an RDN (relative distinguished name.) They have the same CN, but different DNs. You might notice that you run into problems if you have two people in your organization named Ryan Ries, and you'll have to make the SamAccountName for the second one something like
A DN (distinguished name) isn't good to log in with, because who wants to log in to a system with a username like
CN=ryan,OU=Texas,DC=brazzers,DC=com ? While using a DN does uniquely and definitively identify a user, it's annoying to have to type out. It's the same kind of concept between relative paths and absolute paths on a file system. It also implies that you know exactly where in the directory structure the object is located without having to search for it. Which you often do not.
This is called Ambiguous Name Resolution (ANR) - searching the directory for a user when you do not have his or her distinguished name.
UPN (User principal name) is pretty good because they look like email addresses, they can be the same as the user's corporate email address, they're easy to remember, and they are preferred to log in with because the name will be searched for in the local domain first, before searching for it in the forest.
Microsoft says: The point of the UPN is to consolidate the email and logon namespaces
so that the user need only remember a single name. The UPN is the preferred logon name for Windows users. Users should be using their UPNs to log on to the domain. At logon time, a UPN is validated first by searching the local domain, then the global catalog. Failure to find the UPN in the local domain or the GC results in rejection of the UPN. The UPN can be assigned, but is not required, when the user account is created.
Keep in mind that "not required" bit at the end when designing your applications.
SamAccountName is also good because SamAccountName needs to be unique for everyone in the domain (but not the forest.) In addition, SamAccountNames are short. Most people log in with SamAccountNames, even though they do not uniquely identify you in an AD forest, which is why you have to specify a domain name to go along with your SamAccountName so that the system knows what domain you are trying to log in to.
Here's some great documentation on the issue for further reading: