The ARS v7.4.4 documentation details for "rSTS for Federation Authentication" do not work. it states to use the user´s UPN:
So if you configured rSTS for the WI as documented:
It fails with the following error:
Use the Emailaddress value instead:
Note that the user must have a valid email address, if they don´t it will not work.
Our Product Team has raised CR #278459 to update the Active Roles documentation with the correct details.