SAML Authentication Failure with "The User Name or Password Is Incorrect" Due to Missing Windows Authorization Access Group Permissions

Symptoms

Users are unable to log in through SAML authentication and receive an authentication failure.

The RAS logs contain entries similar to the following:

[T 00/00000000/T13E0/P1928] 10-08-26 12:41:43 - AuthenticateUser before checking settings User <username> on Domain <domain>

[E 00/00000000/T13E0/P1928] 10-08-26 12:41:43 - Failed to logon using LsaLogonUser S4U User '<username>@<domain>'. (The user name or password is incorrect. [0x0000052e])

[W 06/0000000D/T13E0/P1928] 10-08-26 12:41:43 - Logon failed user '' client IP '<client_ip>' Secure Gateway IP '<gateway_ip>' Timings [AuthUser: 16 ms, LogonUPN: 0 ms, LogonSTD: 16 ms, CacheSID: 0 ms] The user name or password is incorrect. (1326)

Cause

The issue occurs when the RAS Connection Broker(s) do not have the required permissions to retrieve user authorization information from Active Directory.

If the Connection Broker computer accounts are not members of the Windows Authorization Access Group, the S4U (Service for User) logon process may fail, resulting in authentication errors such as:

Error 1326

Error 0x0000052e

"The user name or password is incorrect"

Even though the user credentials are valid, the authorization lookup cannot be completed successfully.

Resolution

Add all RAS Connection Broker server computer accounts to the Windows Authorization Access Group in Active Directory.

1. Open Active Directory Users and Computers.
2. Locate the Windows Authorization Access Group.
3. Add all RAS Connection Broker computer accounts to the group.
4. Allow Active Directory replication to complete (if applicable).
5. Test the SAML login again.

After the Connection Brokers are added to the Windows Authorization Access Group, SAML authentication should complete successfully.