Abuse of Active Directory Certificate Mapping

An identity with effective write access to an Active Directory user's altSecurityIdentities attribute can add an explicit mapping for a certificate the operator controls. Certificate-based Kerberos authentication succeeds only when the certificate and private key are valid for the configured KDC and the mapping matches; current strong certificate mapping requirements make UPN-only or subject/issuer-only mappings insufficient in many environments. The procedure requires network access to AD Web Services and a Kerberos KDC; an Internet-accessible variant exists only when those domain-controller endpoints are intentionally reachable from the operator's Internet connection and the operator already has an authorized identity with the required write permission. Do not assume these services are publicly exposed. This record covers authorized testing of an approved, trusted certificate and a deliberately scoped test account.