Thanks for the quick reply. When I successfully authenticate on the Test Login page, both user@domain.tld and user@domain work (domain\user doesn't). From the client, user@domain and domain\user both produce "unknown user" errors in the log:

ERROR [VcoFactoryFacade] Unable to login (Ex: javax.security.auth.login.LoginException: Cannot login user : domain\user, user unknown)