Q: WSO2 IS 5.1 adding @carbon.super to username while authenticating with Password Grant We recently migrated (registry and user store) from WSO2 IS 5.0 to WSO2 IS 5.1 as per instructions at WSO2 migration guide. After migrating and successfully bringing up the WSO2 IS server, when we are trying to authenticate existing user with /oauth2/token endpoint the authentication is failing. We can see user along with user attributes in user store.
On WSO2 server we are seeing error -
{org.wso2.carbon.identity.oauth2.token.handlers.grant.PasswordGrantHandler} -  Token request with Password Grant Type received. Username : <username>@carbon.superScope : openid, Authentication State : false

This is migrated user so we can not change the user name. I tried googling to disable the multi tenancy with 5.1 as we do not use that feature, but no luck.
This is blocking us from moving to newer version of WSO2.
Has Any one fixed this?
Modified the SP to disable domain name as per instructions from Gusto2 -
enter image description here
But still same results.

A: on the duo identity provider configuration page, under federated authenticators, put "true" in the "disable tenant domain" box 

A: This solution may help. You can go to your identity server and navigate to the service. Now click on edit button of your target service and go to Local & Outbound Authentication Configuration section and uncheck following options-

*

*Use tenant domain in local subject identifier


*Use user store domain in local subject identifier
I am showing in the image. Follow the red mark box -

