I've Smart Card/CAC authentication setup to work with ADFS for SSO purposes, it works when I have the UPN attribute defined in user's profile in Active Directory that matches the UPN value from the Subject Alternative Name field off the Smart Card/CAC cert.

Issue is that I have some Smart Cards/CAC's without the Subject Alternative Name field and thus don't have the UPN field/value and this is where authentication fails and doesn't work.

I've tried using the CN attribute by forcing ADFS to look at this attribute only by running the following command:

Set-AdfsClaimsProviderTrust -TargetIdentifier "AD AUTHORITY" -AlternateLoginID mail -LookupForests contoso.com (https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configuring-alternate-login-id)

It seems whatever attribute I choose ADFS/AD is looking for the SAN and the UPN attribute from the cert.

Appreciate any help with this issue.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.