SSO credential mapping with Symantec

We found the solution. We had to work inside the policy to assign session variables and remove the additional code that Symantec was adding to the password. This allowed us to take the full password (with symantec code) and send it to radius as a named variable, and have the last.password be the actual user's password to check it against AD since you cannot name the variable to be used for AD auth.