v18 KERBEROS and UPN instead of sAMAccountName

Question

Cheers folks... 
 
 i've setup a fresh v18 in one of our customers deployements... 
 
 So far so good. BUT: 
 WAF Auth NTML based running, BUT using DANG sAMAccountName.... WTF !!! 
 Problem is... I have for example 2 users:

DisplayName 
 Mail 
 sAMAcoountname 
 UPN

Max Muster - Companyalias 1 
 m.muster@company 1 .tld 
 maxMuster 
 m.muster@company 1 .tld

Max Muster - Companyalias 2 
 m.muster@company 2 .tld 
 maxMuster1 
 m.muster@company 2 .tld

... users use UPN to login ... everywhere !!!! cause with DAMN v9UTM I COULD USE UPN! 
 
 Now USING DAMN XG and v18 nothing works... 
 
 NTML works fine according to Logs... BUT my wonderful kerberos is not... 
 
 SPNs are fine. Advanced Log outputs sth like: 
 initialize_kerberos(): gss_acquire_cred HOST/RZ1@xxx.LOCAL: No key table entry found for HOST/RZ1@xxx.LOCAL 
 
 i mean ... no .. .enough... 
 
 any ideas ? 
 
 Cheers, 
 
 Chris

Vishal_R · Answer

Hi ChrisBKA

Unfortunately since inception sAMAccountName is getting used by the XG Firewall for user authentication and not the UPN.

Authentication with UPN is kind of feature request at the moment and below is the existing thread on Ideas portal.

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/18712525-keep-the-upn-added-to-the-userid-for-multiple-doma

For kerberos, "No key table entry found" error please check below thread and confirm the suggested steps if that works for you:

https://community.sophos.com/products/xg-firewall/f/authentication/118573/set-up-kerberos-in-v18#pi2151filter=all&pi2151scroll=false&pi2151=1