Kerberos.app AD UPN & SAM authentication issue

Hi,

Has anyone come across an issue where you cannot authenticate using the
Kerberos.app (or kinit) with an AD account with a different name for the UPN
and SAM? The SAM will authenticate but not the UPN? If the UPN and the SAM
are the same it authenticates. Hope I explained my self ok...?

E.g.
Trying to authenticate as "bob.jackson"
Account:
UPN: bob.jackson@test
SAM: bjackson
.....Doesn't work

Trying to authenticate as "bjackson"
UPN: bob.jackson@test
SAM: bjackson
.....works!

If I change the SAM account to the UPN bob.jackson it works?

Any ideas..i am completely stumped and wasted to much time trying to figure
it out.

Also, why cant I authenticate with the true UPN name: bob.jacskson@test?

Is it something I have to change in the edu.mit.kerberos file? See below
example?
----
[libdefaults]
default_realm = TEST.DOMAIN.WIN
dns_fallback = no

[realms]
TEST.DOMAIN.WIN = {
kdc = testdc.test.domain.win.:88
admin_server = testdc.test.domain.win.
---

Thanks for any tips,

Ben W Young

Technology Services Administrator
DET NSW - Northern Sydney Region
0423604634




**********************************************************************
This message is intended for the addressee named and may contain
privileged information or confidential information or both. If you
are not the intended recipient please delete it and notify the sender.
**********************************************************************
.

Relevant Pages

  • Re: Kerberos.app AD UPN & SAM authentication issue
    ... Kerberos.app with an AD account with a different name for the UPN ... The SAM will authenticate but not the UPN? ...
    (comp.protocols.kerberos)
  • Re: Kerberos.app AD UPN & SAM authentication issue
    ... I think you have to differentiate between the different principal types. ... Also when using the UPN with the canonicalisation flag set AD returns ... The SAM will authenticate but not the UPN? ...
    (comp.protocols.kerberos)
  • Design/Pattern guidance to refector my current design for unit testing
    ... short requiredRoleID, out UserAccount account); ... When the application consuming AuthMgr starts up, ... Authenticate auth = new Authenticate; ... // This stuff is all here so I can unit test the authentication system ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Child Domain access
    ... > You wrote...."So you logon TO A PC using a set of credentials from a ... > should be able to authenticate in the child domain with domain / ent admin ... > account which exists in the TRUSTED parent domain? ... So if the PC is in the child domain you can logon to IT ...
    (microsoft.public.windows.server.active_directory)
  • Re: Requiring User Name and Password for Connection to Network Res
    ... If you don't have a matching account on the server, and if the Guest account on ... then the server should request that you authenticate ...
    (microsoft.public.windowsxp.network_web)