As was pointed out by others, adding extra "known" characters does not make the password less secure, since entropy is a measure of how many other values the password could have assumed -- and a systematic deterministic appending of characters does not change that number.
However, there is a feedback. The password is chosen by a human and will be typed by a human, and is constrained by three kinds of rules:
- The user will have to remember the password.
- The user will have to type the password (often).
- The password policy will usually enforce a minimal size.
The "minimal size" policy is a way to prevent users from using 3-letter passwords or so. Indeed, users tend to maximize their utility function (as economists say), i.e. they will use passwords which make their life easier. A very short password is easy to type and easy to remember. But this often leads to passwords which are way to easy to crack, hence a policy of having a minimal size (often 8 characters). In that context, appending the user name has two evil effects:
- Since the user prefers short passwords when he has to type them, this will incite the user to reduce the amount of "random characters" in his password.
- The "minimal size" policy is bypassed.
Indeed, if the user has name "foobar" and needs to comply with a policy of "at least 8 characters" then he will try for use a password like "foobar42", which is not safe at all... since its effective length is then 2 characters, not 8.
The bottom-line is that while inserting or appending the user name in the password does not reduce security when all other things remain the same, the other things tend to be altered at the same time. In particular, a "minimal size" policy should be altered into: "at least n characters excluding a copy of the user name, if applicable". You want "foobar42" to be measured, for this policy, as a password of length 2, not 8.
This also illustrates the creativeness of human users. They will try hard to work around your policies if these policies make their life harder. To achieve better security, you really need to obtain the user's cooperation, which implies a lot of pedagogy, and helper tools (in particular, you should provide a non-mandatory password generator, for users who want to generate a good password -- some will use it).