Password login flow & Kerberos

[Tom Zeller]

> Problem: if I can authenticate with Password login flown with Kerberos and set uid attribute to my login username, I didn't succeed to get other principalName LDAP attributes on my AD...
>
> So I configure my IDP to authenticate with Password login flown with LDAP adAuthenticator.

I would say stop there, and, instead, separate authentication from
attributes. Configure an LDAP DataConnector and appropriate
AttributeDefinitions in attribute-resolver.xml to get the attributes
you want (and of course filter them appropriately in
attribute-filter.xml). In other words, I don't think it's a best
practice to rely on authentication for attributes.