In our company exists a forest-wide UPN suffix company.com
and almost all user accounts have the explicit UPN set to fistname.lastname@company.com
. This value is also set in the Active Directory userPrincipalName
attribute.
Now we have an application where users perform authentication through Kerberos. So we are given the Kerberos principal, i.e. implicit UPN. We'd like to look up that user and retrieve several LDAP attributes. Since iUPN and userPrincipalName
do not match anymore, the lookup is not possible.
Is there any "official" way to retrieve a mapping from the Active Direcory? My workaround is to perform a LDAP bind against the realm component and search for the sAMAccountName
attribute which matches the user id component of the iUPN. Searching for the mere sAMAccountName
in the forest is not possible because the value is unique in the domain only.