I've Smart Card/CAC authentication setup to work with ADFS for SSO purposes, it works when I have the UPN attribute defined in user's profile in Active Directory that matches the UPN value from the Subject Alternative Name field off the Smart Card/CAC cert.
Issue is that I have some Smart Cards/CAC's without the Subject Alternative Name field and thus don't have the UPN field/value and this is where authentication fails and doesn't work.
I've tried using the CN attribute by forcing ADFS to look at this attribute only by running the following command:
Set-AdfsClaimsProviderTrust -TargetIdentifier "AD AUTHORITY" -AlternateLoginID mail -LookupForests contoso.com (https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configuring-alternate-login-id)
It seems whatever attribute I choose ADFS/AD is looking for the SAN and the UPN attribute from the cert.
Appreciate any help with this issue.