This message was deleted.

I'm not across cert based auth so don't know for sure if this will work, but you could look a Traffic Profile and play around with the SSO User Expression - may do what you need?

Interesting Request, maybe something like AAA.LOGIN.USERNAME.AFTER_REGEX(re#@#).EQ("domain.com") as expression for the Traffic Policy and AAA.LOGIN.USERNAME.BEFORE_REGEX(re#@#) + "@newdomain.com" as User Expression in the Traffic Action

nFactor helps you. 😜

Another, I think easier idea: • As samaccountname does NOT change, is it possible that my adc accepts both certificates (samaccountname@domain.com and samaccountname@newdomain.com) BUT sends the samaccountname, NOT the UPN to the ldaps auth, so it should accept the authentication in both ways Any example of rewriting this? maybe delete the @domain.com / @newdomain.com after accepting the cert? Thanks!

In that case maybe just SSO Name Attribute in the LDAP server configuration?

Thanks for your help. The following article get me to an idea: https://support.citrix.com/article/CTX231525 I set the user expression for the certextract loginschema to aaa.user.name.after_str("@") + "\\" + aaa.user.name.before_str("@") -> Users with old Usercerts like samaccountname@domain.com getting rewrote to netbios\samaccountname -> Users with new Usercerts like samaccountname@newdomain.com getting rewrote to netbios\samaccountname since only the UPN Suffix is changing and not the netbios, it works in both ways 🙂 mission complete!