A Office 365 Shared Services Blog https://docs.microsoft.com/archive/blogs/nigelw/feed.xml A Blog from an Microsoft CTS engineer based in the UK EMEA, to provide help and information on common issues we see related to the team I work in which is Shared services Wed, 17 Apr 2019 03:30:03 GMT en-US hourly 1 ADFS logon issue "Your organization could not sign you into the service" 0x80041034 https://docs.microsoft.com/archive/blogs/nigelw/adfs-logon-issue-your-organization-could-not-sign-you-into-the-service-0x80041034 Wed, 23 Jan 2013 04:00:20 GMT https://blogs.technet.microsoft.com/nigelw/2013/01/23/adfs-logon-issue-your-organization-could-not-sign-you-into-the-service-0x80041034/ https://support.microsoft.com/kb/2535191

https://social.technet.microsoft.com/wiki/contents/articles/4110.ad-fs-2-0-claims-are-missing-from-the-output-claim-set-after-a-user-s-name-has-changed.aspx

After a user rename in the local Active directory, (the samaccount name, or UPN prefix)
The user is unable to logon the error displayed in a dialog suggests  "Your organization could not sign you into the service"
All other users are still able to logon only the users who have recently had there names chnged experience the issue.

Symptoms
•         Federated logon fails for some users. Other users are fine.
•         Embedded HR code is 0x80041034 (PP_E_INVALID_MEMBERNAME The specified member name is either invalid or empty)
•         Samaccountname has changed recently for user
•         Netmon trace on ADFS server(s) at repro shows LDAP query use wrong samacccountname

Cause
 
LSA cache on AD FS server(s) has stale entries for SID of the user. Therefore SID ? Domain\Old_Samaccountname instead of SID ? domain\current_samaccountname
 
The LDAP query performed for claim generation fails to return attributes as it gets not hit when searching by old samaccountname. Thus, ADFS issues an empty token without saml:attributestatement. So OrgID generate 0x80041034 (PP_E_INVALID_MEMBERNAME The specified member name is either invalid or empty)
 
Resolution
 
Disable SID cache temporarily using LsaLookupCacheMaxSize as per https://support.microsoft.com/kb/2535191
You could also either
•         reboot ADFS server
•         Change samaccountname back to previous value in AD
•         Use psgetsid.exe from sysinternals to update LSA cache on AD FS server(s)

 

 

]]> Technical discussions on Office 365 / for shared services / the domains part of Office 365 / ADFS / Directory sync https://docs.microsoft.com/archive/blogs/nigelw/technical-discussions-on-office-365-for-shared-services-the-domains-part-of-office-365-adfs-directory-sync Wed, 23 Jan 2013 03:51:00 GMT https://blogs.technet.microsoft.com/nigelw/2013/01/23/technical-discussions-on-office-365-for-shared-services-the-domains-part-of-office-365-adfs-directory-sync/ First blog

This blog is intended to cover the technologies I support as a Microsoft technical support engineer.

I work in the CTS team for Microsoft in the UK (EMEA), dealing with what we term as shared services (identity) related issues.

Issue relate to ADFS, Logon, Directory Sync, AD to Cloud issues, the areas where the Exchange / Lync / SharePoint teams do not cover.

I hope to blog on common issues I see with my technologies so hope that this information may be of use the anyone running into problems.

Thanks

]]>