Passing Email Unchanged to the AD LDAP Connector Using the Auth0 Lock Widget in the Classic Login Page

This article clarifies how to send a complete user email address to the Active Directory (AD) Lightweight Directory Access Protocol (LDAP) connector when using the Auth0 Lock widget on a Classic Universal Login page.

• Classic Universal Login Page

• Lock

• LDAP connector

By default, Lock is configured with defaultADUsernameFromEmailPrefix: true. This setting instructs the widget to examine the user input and, if it matches an AD or LDAP domain, strip the domain and send only the prefix to the LDAP connector. For example, the input <user@example.com> results in only the prefix <user> being sent to the connector.

To ensure the entire email address is sent to the LDAP connector, perform the following steps:

1. Go to Branding > Universal Login > Manage Classic Login.

2. Select the Login tab.

3. Locate the options object passed to the Auth0Lock function.

4. Set the defaultADUsernameFromEmailPrefix parameter to false.

var options = {
  // ... existing options ...
  defaultADUsernameFromEmailPrefix: false
};

var lock = new Auth0Lock('<user>', '<account>.auth0.com', options);

Open the AD/LDAP connector log to verify that the user authentication attempt contains the entire email address.

2026-01-01T21:00:12.345Z - debug: [2026-01-01 21:00:12] user user@example.com: Starting authentication attempt.