Got it after some hours of research, now with vCenter 8.0u2!
Step 1:
According to
https://kb.vmware.com/s/article/78029
Step 6 you create a UPN Claim Rule in ADFS. This is the part that has to be done in a different way. If you already have created this claim rule, remove it.
Create these two custom claim rules instead:
Rule 1, on rule position 3
Name: User Principal Name query sAMAccountName
Claim:
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> add(store = "Active Directory", types = ("ssupn", "sswindowsaccountname"), query = ";UserPrincipalName,sAMAccountName;{0}", param = c.Value);
Rule 2, on rule position 4
Name: User Principal Name replace UPN Domain Name
Claim:
c1:[Type == "ssupn"]
&& c2:[Type == "sswindowsaccountname"]
=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", Value = c2.Value + "@<yourdomain.local>");
Replace <yourdomain.local> with the internal ADDS domain.
These claims works fine here, also with Azure MFA, which was the reason why I needed to use usernames with the offical domain in the UPN.
I hope my research will save you some time and improve the security of your vCenter deployment.
Have fun,
Lothar
