Mapping users with a differing sAMAccountName and UPN in Active Directory

devsda1 · August 28, 2026, 1:25pm

We have a few student researchers who have been at our institution for long enough that a change many years ago which standardised usernames is causing weird issues in our Open OnDemand environment.

The OOD VM is joined to our Active Directory, with users authenticating in their browsers via MS365 which sends their UPN. Since 99.9% of users have both a matching legacy sAMAccountName and UPN, home directory mapping goes through without an issue. However with the very few users that have this mismatch, home directory mapping fails as `Etc.getpwuid` seems to use passwd which doesn’t put the two together, instead of getent passwd which does correctly link the UPN and sAMAccountName together.

We currently have an exception in place for these few users that let them login to the portal via SSH however Cyber isn’t too keen on this staying put (which unfortunately we don’t have much leeway over). This is definitely a very niche bug so I’m not sure if there’s any actual workarounds we could use here. Has anyone else tackled this at their site?

jeff.ohrstrom · August 28, 2026, 3:35pm

That is a tough one. What’s the behavior of the app when the login through the UI? I mean what’s the specific error they encounter?

devsda1 · August 28, 2026, 8:33pm

Right now they’re just shown our “Home directory not found” page. I think there was an instance where they got a blank page that just showed “Invalid user 123456” (not their actual username), but they haven’t provided a screenshot of this.

jeff.ohrstrom · August 28, 2026, 9:10pm

Seems like re implement our use of Etc.getpwuid wherever we use it.

Initially it’s here:

github.com/OSC/ondemand

nginx_stage/lib/nginx_stage/user.rb

495a75335


      
          # @param user [String] the user name defining this object
          # @raise [ArgumentError] if user or primary group doesn't exist on local system
          def initialize(user)
            # See if user is all numbers (potentially uid), regexp is 8% faster than integer conversion
            # Benchmark: 0.13 microseconds per call (1M cycles)
            if user.match?(/\A\d+\z/)
              # The user is composed of all numbers, (numeric string)
              #  10 microseconds per call if it matches
              # 203 microseconds per call if it doesn't match (only happens if username is all numbers but not a uid)
              begin
                @passwd = Etc.getpwuid(user.to_i)
              rescue ArgumentError
                # We got a number as a username but we failed the lookup, fallthrough to the string lookup
              end
            end
          
            # Variable is not set, so the user is a string
            unless @passwd
              # Benchmark: 13 microseconds per call (1M cycles)
              @passwd = Etc.getpwnam(user)
              if name.to_s != user.to_s

Then when the dashboard boots up here:

github.com/OSC/ondemand

apps/dashboard/lib/current_user.rb

495a75335


      
            delegate :primary_group, :primary_group_name, :group_names, :filtered_group_names, :groups, to: :instance
          
          
            alias_method :home, :dir
          end
          
          attr_reader :pwuid
          delegate :name, :uid, :gid, :gecos, :dir, :shell, to: :pwuid
          
          def initialize
            @pwuid = Etc.getpwuid
          end
          
          def primary_group
            @primary_group ||= Etc.getgrgid(gid)
          end
          
          def primary_group_name
            @primary_group_name ||= primary_group.name
          end

If you have a test or dev instance you don’t mind corrupting and possibly rolling back or re-installing ondemand, it may be worth a go, but seems quite dangerous anyhow. You can issue commands in ruby with backticks like this `getent passwd`.

Again going to kind of a big lift and probably even a bit dangerous, but I’m not really sure what else can be done.

devsda1 · August 28, 2026, 10:38pm

We’ll have a poke around with it on our dev instance, I did speak to our systems head earlier today who said they might just go down the route of renaming the affected account to match, which if it doesn’t cause issues with any other systems, will probably be the preferred fix until the few remaining students with this discrepancy graduate out over the next year or so

devsda1 · September 11, 2026, 10:40am

This issue was thankfully the motivation needed internally to fix the affected users once and for all on the IdP end where our systems guys renamed their sAMAccountName to their UPN, and will be doing this for the few remaining researchers with this discrepancy so we don’t need to go digging into the OOD source and potentially make things vulnerable.

This was thankfully easy for them to do since the rest of our services already go by UPN anyway, I can’t say this’ll be as painless at other places that might come across this in the future

Topic		Replies	Views
User is being mapped to old username, even after map file is updated to local username Get Help	3	833	January 18, 2022
User mapping doesn't work for ad users with accounts in /etc/passwd Get Help	9	332	September 6, 2024
Need help with mapping usernames Get Help	7	412	March 18, 2024
Missing Home Directory Error Get Help	26	4230	October 17, 2019
Error - failed to map user Get Help question	17	2575	April 18, 2021

Mapping users with a differing sAMAccountName and UPN in Active Directory

Related topics