Question

I used the following code to perform authentication to AD server

using (var context = new PrincipalContext(ContextType.Domain))
{
     return context.ValidateCredentials(samAccountName, password.RetrieveString()
                                               , ContextOptions.Negotiate);
}

The thing is, it will only work if I use "[e-mail]", it will not work if I use "domain\user".

Any idea why?

Answer 1

For Kerberos to work, you need to do ‘user@domain’ if the user is not currently logged into that domain. If logged into the domain, “domain\user” should work.

This is my experience on our Kerberos network.