Major Description
Active Directory enables other methods of binding which are more flexible besides just using the distinguished name. https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/6a5891b8-928e-4b75-a4a5-0e3b77eaca52. This change is to enable binding the the User Principle Name form, which is very convenient when the distinguished names for users is not easily available (OU by department, etc.).
"For AD DS, the name forms are tried in the order they are listed below. For AD LDS, the name forms are tried in the order below, except that forms marked "Only for AD DS" are not tried, and the User Principal Name (UPN) mapping (the second form below) is tried last.
The name forms are:
The DN of the object.
The user principal name (UPN) of the object. The UPN of an object is either:
A value of the userPrincipalName attribute of the object, or
Only for AD DS: The value of the sAMAccountName attribute of the object, followed by a "@" sign, followed by either:
The DNS name of a domain in the same forest as the object, or
A value in the uPNSuffixes attribute of the Partitions container in the config NC replica."
"For AD DS, the name forms are tried in the order they are listed below. For AD LDS, the name forms are tried in the order below, except that forms marked "Only for AD DS" are not tried, and the User Principal Name (UPN) mapping (the second form below) is tried last.
The name forms are:
The DN of the object.
The user principal name (UPN) of the object. The UPN of an object is either:
A value of the userPrincipalName attribute of the object, or
Only for AD DS: The value of the sAMAccountName attribute of the object, followed by a "@" sign, followed by either:
The DNS name of a domain in the same forest as the object, or
A value in the uPNSuffixes attribute of the Partitions container in the config NC replica."