...

The 'enabled' box on the ADS Configuration domain must be checked and the user's account in SYSTEM>User must have the 'external authentication' box checked as well in order to use ADS.  Users that don't have the 'External Authentication'  box checked will authenticate locally. 

For example, consider the user "miller" in a domain "mcoecn.org".   If the "ADS Domain" field is left blank, then the user must specify the fully qualified name of "miller@mcoecn.org" when logging in and the username field in user's account must contain "miller@mcoecn.org".  However, if the "ADS Domain" field contains "mcoecn.org", then the user can login without specifying the domain, and the profile username is simply "miller".

For this reason, when configuring multiple domains, it is strongly recommended that only one domain specify an "ADS Domain".  The others should be blank to force the user to specify the fully qualified name to prevent collisions.  If a default is provided for more than one domain, and a user "miller" exists in both domains, they will share the same profile in the application.

...

More Information on ADS Configuration 

Please refer to the 'Configure' section of the /wiki/spaces/rtd/pages/2752939 for more information.

...