Kerberos Authentication with different UPN than Kerberos Realm

APM Kerberos SSO doesn't currently support Kerberos "canonical enterprise referrals", that is it can't chase a referral sent by the KDC for another realm. I'm assuming your "@nnn" is an alternate UPN suffix in the same domain, but this still requires canonical referrals. What you need to do to make this work is to specify the user's real name and real domain. And since the user's real userPrincipalName contains the alias realm, you have to send the sAMAccountName value instead. Your access policy might then look something like this:

start -> on demand cert auth -> ocsp auth -> LDAP query -> variable assign -> allow

where the LDAP query looks up the user's sAMAccountName value based on the userPrincipalName. The variable assign puts the returned username value into the right username session variable for the SSO profile. Example:

session.sso.token.last.username = return [mcget {session.ldap.last.attr.sAMAccountName}]

Or you can alternatively skip the variable assign and make session.ldap.last.attr.sAMAccountName the input username source variable within the SSO profile.