Is there a way to accept both SAMAccountName AND UserPrincipalName for user authentication?

[Will_Baldwin]

Bottom line I would like my user to be able to authenticate using either "MyUserID" or "MyUserID@MyDomain.com".  Can this be done?

Right now, my users authenticate using their SAMAccountName/userID.  As we move toward x.509 Personal Certificate authentication, the user certs provide a UPN (email address).  Given a user who has a SAMAccountName of "MyUserID" and UserPrincipalName of "MyUserID@MyDomain.COM"; is there a way to setup Authentication Profiles to strip off the "@mydomain.com" and thus always send the radius server just "MyUserID" for account matching?

I've been looking at Authentication Profile -> Username Modifier but I don't yet see a way to accomplish what I am looking for. 

Any suggestions?

[dmifsud]

I think you were looking in the right place, the username modifier is explained here and seems to be what you want:

Authentication Profile (paloaltonetworks.com)

 If you specify the %USERDOMAIN% variable and leave the User Domain blank, the firewall removes any user-entered domain string.

- DM