AD QUERY AFTER KERBEROS AUTHENTICATION

I had a similar issue where my domain name was getting appended to the username twice in the AD query. IE: the username was being sent across in the AD Query as: username@DOMAIN.com@domain.com.

My fix was to add a "Variable Assign" between the Kerberos and AD Query steps within my Policy.

I set the Custom Variable field to:

session.logon.last.username

Then set the Custom Expression field to:

expr { [lindex [split [mcget {session.logon.last.username}] "@"] 0] }