Error: Unable to uniquely identify the user using provided claims (4249896)

After configuring Authentication for the Active Roles Web Interface, the following error message is shown after authenticating with the integrated provider credentials, such as Azure, Okta, or Duo:

Unable to uniquely identify the user using provided claims. Please contact your Active Roles Administrator

or

Cause 1

• The user logging in to the Active Roles Web Interface is unable to be uniquely mapped to an object in either Azure or Active Directory using the provided claims type

Cause 2

• The Active Roles Application Pool ARWebAppPool is not configured with the correct identity

Cause 3

• Group Policy Object Deny access to the user log on Active Roles from the network

Cause 4

• Group Policy blocking the Secure Token Server service from authenticating to Active Directory (applicable to Active Roles 8.2 and later).

Resolution 1

• Ensure the attribute used by the claim type is unique in both Azure AD and Active Directory
  • ​For example, if the claim type is configured to use UPN, ensure the user accessing the Web Interface has a UPN that is unique in both Azure AD and Active Directory

Resolution 2

• On the Active Roles Web host, Ensure the ARWebAppPool Application Pool in IIS is configured to use the Identity LocalSystem

Resolution 3

• Ensure there is no GPO configured allowing only specific users to log in to the Active Roles server.

Resolution 4

• Add the Active Roles computer into the Pre-Windows 2000 Compatible Access group.