APM ClientCert to Kerberos Transition - parsing SubjectAlternateName in Variable assign

Hi Guys,

just came up with a nasty thing Microsoft throws at us 😄 It looks like the Kerberos Client Principal is build by sAMAccountName@REALM. I stumbled across this, while adding another division to my Virtual Server, which uses different values in the UPN and sAMAccountName field (e.g.: UPN = first.last@maildomain vs. sAMAccountName=last). Couldn't find a reference at Microsoft, but at least it's working with the following variable assignment (the ldap.attr.Name is case sensitive - gave me some headache too):

expr { [mcget {session.ldap.last.attr.sAMAccountName}] }

extracting the REALM from the DN remains the same:

expr { [string toupper [string map -nocase {,dc= .} [string range [mcget {session.ldap.last.attr.distinguishedName}] [expr [string first ",DC=" [mcget {session.ldap.last.attr.distinguishedName}] 0] +4] end ] ] ]}

Cheers JP