GlobalProtect SSO with Kerberos returns user display name

[Chacko42]

Hi Community,

I'm a bit confused by a internal GlobalProtect installation:

I configured Kerberos SSO and created an aut-sequence with Kerberos SSO and LDAP as fallback.

The customer is using a third-party Credential Provider (Windows 10) so we did the CP-Wrapping by changing the registry key GUID.

Now, after a client logs in to windows, I got a failed Kerberos login with "Chuck Norris" inside the log.

Possible user-matches would be <netbios-name>\cnorris or chuck.norris@<fqdn>.

How can I tell the GlobalProtect client to use the SamAccount Name or UPN for SSO?

PAN-OS 8.1.7, GP 4.1.11

Looking forward to your input

Best Regards

Chacko