Paloalto Auth Profile

We want people to be able to sign into captive portal with user@domain.com or just user. We've tried all sorts of combinations with the modifiers and domain, but haven't had it work both ways. We've had it work with one setup where it let them log in both ways, but would only see the user's AD groups if they signed in as user@domain.com. When they signed in as just user, it let them in but didn't see their AD groups. Anyone here have this working this way? LDAP