UPN check
Pre-requisite: RA certificate caching must be enabled.
Logon as Domain administrator
Start Active Directory Users and computers
Make sure in View menu you have Advanced Features enabled:
Search for user you are using for authentication:
Make a right-click and select Name Mappings
Add user´s certificate (found on previous chapter Verify certificate Subject Alt Name (SAN), point 3)
Try to authenticate. If this helps resolve the issue, problem is on correct mapping of certificate to AD account.
Remove explicit mapping. This is only for testing.