As of active-directory 1.27, the system resolves the full LDAP name for the user, and apparently attempts to use this rather than the username for comparison in matrix based authentication. This is a pain, since it's much easier and more consistent to use usernames for rights management (plus that's how it used to work).