Applies to: Centrify Direct Control 5.4.0 on all supported platforms

Question: 
Why was the default value of adclient.krb5.principal changed from "upn" to "sam" in centrifydc.conf?

Answer: 
Centrify changed the default for this parameter to be "sam" to follow kerberos default behavior. By default, AD user's Kerberos name is generated as samAccountName@<AD REALM>.  

Configuration Notes:
This parameter’s default is changed from "upn" to "sam". This is because an Active Directory user's Kerberos name is generated as sAMAccountName@<AD REALM> by default. To be consistent with this new default setting, for a name format such as <name>@<REALM>, the DirectControl agent will now try sAMAccountName (SAM@DOM) format match first and then UPN.

Note:
If you really want to set adclient.krb5.principal.name to "upn", be aware of a potential issue when a user’s (userA) UPN matches another user’s (UserB) sAMAccountName and the UPN domain suffix matches the domain realm. In this case, userA will not be able to login using his own password, and userB who logged in using his sAMAccountName could SSO to userA's account because of the confusion induced from matching UPN with SAM@DOM.

For an Active Directory user mapped to MIT user, the Kerberos name generation will ignore this setting as before