Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-8662: Why was adclient.krb5.principal changed from "upn" to "sam".

Authentication Service ,  

1 May,17 at 04:43 PM

Applies to: Centrify Direct Control 5.4.0 on all supported platforms

Why was the default value of 
adclient.krb5.principal changed from "upn" to "sam" in centrifydc.conf?

Centrify changed the default for this parameter to be "sam" to follow kerberos default behavior. By default, AD user's Kerberos name is generated as samAccountName@<AD REALM>.  

Configuration Notes:
This parameter’s default is changed from "upn" to "sam". This is because an Active Directory user's Kerberos name is generated as sAMAccountName@<AD REALM> by default. To be consistent with this new default setting, for a name format such as <name>@<REALM>, the DirectControl agent will now try sAMAccountName (SAM@DOM) format match first and then UPN.

If you really want to set to "upn", be aware of a potential issue when a user’s (userA) UPN matches another user’s (UserB) sAMAccountName and the UPN domain suffix matches the domain realm. In this case, userA will not be able to login using his own password, and userB who logged in using his sAMAccountName could SSO to userA's account because of the confusion induced from matching UPN with SAM@DOM.

For an Active Directory user mapped to MIT user, the Kerberos name generation will ignore this setting as before