UseSubjectAltName and smartcard logon

On Windows 7 clients, if a smartcard certificate contains a Subject Alternate Name (SAN) it will by default be used for implicit mapping against a user in AD and whatever has been imported to the AltSecurityIdentities attribute in X509 format (the UPN SAN is special as that looks directly at the UserPrincipalname attribute).

If you want to override the contents of the SAN and use explicit mapping based on things outside of the SAN (like Subject Name and Issuer), you need to disable it on both client and KDC using the UseSubjectAltName registry value.

This also requires Windows 7 on the client side and Windows Server 2008 R2 on the server side (domain controller side).

See http://technet.microsoft.com/en-us/library/ff520074(WS.10).aspx for details.

(see also Spat's entry on http://blogs.msdn.com/b/spatdsg/archive/2010/06/14/howto_3a00_-disable-upn-mapping-for-smartcard-logon.aspx which covers this in more details.)