What UPN formats are supported by Kerberos S4U?

From: Joe Kaplan \(MVP - ADSI\) (joseph.e.kaplan_at_removethis.accenture.com)
Date: 11/23/04

  • Next message: charismatic_evangelist_at_yahoo.com: "Re: Reverse usage of public/private RSA encryption keys for licensing?" 
    Date: Tue, 23 Nov 2004 16:28:13 -0600

    I have what I think is a quick question. I'm using Kerberos S4U to create Windows logon tokens, in this case using the .NET wrapper new WindowsIdentity(string userPrincipalName). What I'd like to know is what UPN formats are supported by this API?

    I assumed that because the function parameter was called userPrincipalName, the value had to be the user's userPrincipalName in AD (e.g joe@fabrikam.com). However, in my testing, I was able to determine that using the user's sAMAccountName in AD worked fine too (e.g. joe).

    Note that this was tested in a single domain/single forest. Also, all the users tested had the sAMAccountName equal to the alias part of the userPrinicipalName, so I don't know if either of those parameters matter.

    Thanks in advance to anyone who can help. This detail isn't covered in the Protocol Transition/Constrained Delegation whitepaper that saw.

    Joe K.

  • Next message: charismatic_evangelist_at_yahoo.com: "Re: Reverse usage of public/private RSA encryption keys for licensing?"

    Relevant Pages

    • What UPN formats are supported by Kerberos S4U?
      ... I'm using Kerberos S4U to create Windows logon tokens, in this case using the .NET wrapper new WindowsIdentity(string userPrincipalName). ...
      (microsoft.public.security)
    • Re: Anyone has an apache running with mod_auth_kerb AND mod_auth_ldap?
      ... (Specified realm `persona.de' not allowed by configuration) ... I recommend steering this thread back onto the kerberos mailing list. ... So what you're saying is that users do not know their userPrincipalName ... You could split the name and do an LDAP search on sAMAccountName=abaker ...
      (comp.protocols.kerberos)