{"id":475,"date":"2017-04-07T12:55:15","date_gmt":"2017-04-07T16:55:15","guid":{"rendered":"https:\/\/www.ccrossan.com\/blog\/?p=475"},"modified":"2017-04-07T12:55:15","modified_gmt":"2017-04-07T16:55:15","slug":"adfs-username-behavior","status":"publish","type":"post","link":"https:\/\/crossan007.dev\/blog\/identity-management\/adfs-username-behavior\/","title":{"rendered":"ADFS Username Behavior"},"content":{"rendered":"\n
Tweet<\/a><\/div>\n

Problem<\/h1>\n

ADFS 4.0 on Windows Server 2016 tells users to log in with their full email address “someone@example.com.” \u00a0This generates many support requests, and complaints about too much typing.<\/p>\n

Additionally, some extranet users may have email addresses not on the\u00a0domain, and it’s unclear which email address they should supply.<\/p>\n

This affects both the ADFS log in page, and the ADFS password change page.<\/p>\n

Solution Methodology<\/h2>\n

ADFS Server 4.0 has PowerShell cmdlets to manage the content delivered to users during authentication requests: https:\/\/technet.microsoft.com\/windows-server-docs\/identity\/ad-fs\/operations\/ad-fs-user-sign-in-customization<\/a><\/p>\n

We’ll focus on the following<\/p>\n

Get-AdfsWebTheme<\/p><\/blockquote>\n

and<\/p>\n

Set-AdfsWebTheme<\/p><\/blockquote>\n

Of particular interest here is that we’re able to modify the JavaScript that runs on these pages.<\/p>\n

Steps<\/h3>\n

Use PowerShell to manage custom ADFS Themes<\/a><\/p>\n

    \n
  1. Export the Default ADFS Theme<\/a> using this snippet:\n
     Export-ADFSWebTheme -Name "Default"\u00a0-DirectoryPath c:\\test<\/pre>\n<\/li>\n
  2. Use your \u00a0favorite editor<\/a> to open c:\\test\\script\\onload.js<\/li>\n
  3. Add the snippets from below (as desired) into onload.js<\/li>\n
  4. Create a New ADFS Theme <\/a>\n
    \u00a0New-AdfsWebTheme -Name BetterDefault -SourceName c:\\test <\/pre>\n
      \n
    1. Set your new theme as the default (best for testing)\n
       Set-ADFSWebConfig -ActiveThemeName BetterDefault <\/pre>\n<\/li>\n<\/ol>\n<\/li>\n
    2. Alternatively, you may update an existing theme<\/a> with your code changes\n
      Set-AdfsWebTheme -TargetName "Default" -AdditionalFileResource @{Uri=\u201c\/adfs\/portal\/script\/onload.js\u201d;Path=\u201cC:\\theme\\script\\onload.js"}<\/pre>\n<\/li>\n<\/ol>\n
      Placeholder\u00a0Text Solution<\/h1>\n
      To update the “someone@example.com” placeholder on both the login and the password change ADFS pages, paste this code into your onload.js, and update your ADFS theme.<\/p>\n
      \r\nfunction UpdatePlaceholders() {\r\n    var userName;\r\n    if (typeof Login != 'undefined'){\r\n        userName = document.getElementById(Login.userNameInput) \r\n    }\r\n    if (typeof UpdatePassword != 'undefined'){\r\n        userName = document.getElementById(UpdatePassword.userNameInput);\r\n    }\r\n    if (typeof userName != 'undefined'){\r\n        userName.setAttribute("placeholder","Username");\r\n    }\r\n}\r\n\r\ndocument.addEventListener("DOMContentLoaded", function(){\r\n  \/\/ Handler when the DOM is fully loaded\r\n  UpdatePlaceholders()\r\n});\r\n<\/pre>\n
       <\/p>\n
      Formatting of the Username field<\/h1>\n
      For single-domain organizations, it may be less than desirable to force users to enter the domain name as part of their username. To “fix” this requirement of entering usernames in a format of “domain\\username” or “username@domain.com”, paste the following code into your onload.js. \u00a0Make sure to update your domain where appropriate.<\/p>\n
      Logon Username Format Solution<\/h2>\n
       <\/p>\n
      \r\n\r\nif (typeof Login != 'undefined'){\r\n    Login.submitLoginRequest = function () { \r\n    var u = new InputUtil();\r\n    var e = new LoginErrors();\r\n    var userName = document.getElementById(Login.userNameInput);\r\n    var password = document.getElementById(Login.passwordInput);\r\n\r\n    if (userName.value && !userName.value.match('[@\\\\\\\\]')) \r\n    {\r\n        var userNameValue = 'example.org\\\\' + userName.value;\r\n        document.forms['loginForm'].UserName.value = userNameValue;\r\n    }\r\n\r\n    if (!userName.value) {\r\n       u.setError(userName, e.userNameFormatError);\r\n       return false;\r\n    }\r\n\r\n\r\n    if (!password.value) \r\n    {\r\n        u.setError(password, e.passwordEmpty);\r\n        return false;\r\n    }\r\n    document.forms['loginForm'].submit();\r\n    return false;\r\n};\r\n}\r\n<\/pre>\n
      Password Change Username Formatting Solution<\/h2>\n
      \r\n\r\nif (typeof UpdatePassword != 'undefined'){\r\n    UpdatePassword.submitPasswordChange = function () { \r\n    var u = new InputUtil();\r\n    var e = new UpdErrors();\r\n\r\n    var userName = document.getElementById(UpdatePassword.userNameInput);\r\n    var oldPassword = document.getElementById(UpdatePassword.oldPasswordInput);\r\n    var newPassword = document.getElementById(UpdatePassword.newPasswordInput);\r\n    var confirmNewPassword = document.getElementById(UpdatePassword.confirmNewPasswordInput);\r\n\r\n    if (userName.value && !userName.value.match('[@\\\\\\\\]')) \r\n    {\r\n        var userNameValue = 'example.org\\\\' + userName.value;\r\n        document.forms['updatePasswordForm'].UserName.value = userNameValue;\r\n    }\r\n\r\n    if (!userName.value) {\r\n       u.setError(userName, e.userNameFormatError);\r\n       return false;\r\n    }\r\n\r\n    if (!oldPassword.value) {\r\n        u.setError(oldPassword, e.oldPasswordEmpty);\r\n        return false;\r\n    }\r\n\r\n    if (oldPassword.value.length > maxPasswordLength) {\r\n        u.setError(oldPassword, e.oldPasswordTooLong);\r\n        return false;\r\n    }\r\n\r\n    if (!newPassword.value) {\r\n        u.setError(newPassword, e.newPasswordEmpty);\r\n        return false;\r\n    }\r\n\r\n    if (!confirmNewPassword.value) {\r\n        u.setError(confirmNewPassword, e.confirmNewPasswordEmpty);\r\n        return false;\r\n    }\r\n\r\n    if (newPassword.value.length > maxPasswordLength) {\r\n        u.setError(newPassword, e.newPasswordTooLong);\r\n        return false;\r\n    }\r\n\r\n    if (newPassword.value !== confirmNewPassword.value) {\r\n        u.setError(confirmNewPassword, e.mismatchError);\r\n        return false;\r\n    }\r\n\r\n    return true;\r\n};\r\n}\r\n<\/pre>\n
      Thanks for reading! \u00a0If you have any questions, feel free to send me a tweet @crossan007.<\/p>\n","protected":false},"excerpt":{"rendered":"
      Problem ADFS 4.0 on Windows Server 2016 tells users to log in with their full email address “someone@example.com.” \u00a0This generates many support requests, and complaints about too much typing. Additionally, some extranet users may have email addresses not on the\u00a0domain, and it’s unclear which email address they should supply. This affects both the ADFS log … Continue reading ADFS Username Behavior<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[204,58,191,47,202,33,29,192,203,201],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\t\n