Allow Flexible UPN Naming in SAS Viya Kerberos-Delegation Scenarios

[MichaelShealy]

SAS Viya currently allows an AD UPN to not be the same name as an SPN in scenarios where a user only IWA's into Viya Login via Kerberos, but not in cases where the Kerberos credentials then need to be delegated downstream to SQLSvr/Hadoop/etc via SAS/ACCESS products.  Some of our clients have internal IT naming-requirements for their UPNs which do not match the HTTP/xxxxxxxxx naming requirements for an SPN. 

I'd like to request that Viya support the UPN name being different from the SPN, in scenarios where the Kerberos credentials will be delegated downstream. 

Many thanks!

[rhmthomson1]

As product manager for SAS/Access I will review this with my development team, and respond accordingly, and potentialy ask some additional questions.

[rhmthomson1]

Having spoken to our Engineers they believe what you are requesting is non-standard, which could require special coding to support.

Are you able to  provide independant documentation as to why this configuration is preferable and more secure? We can then consider this further