We spent a while trying to find a solution to add p: to the SNC string that we get from Active Directory to populate the SNC field on the SNC tab in SU01.
It turns out that you can dso this by by putting “p:#!#USERPRINCIPALNAME#!#” under default settings in EUP.
We are using the UserPrincipalName field in the certificat but the default p:#!#USERID#!#” would work for UserID field...
Just wanted to share this since it caused a lot of grief for us.
P: is appraently required by SAP as part of the X.500 standard, and is not configurable, i.e. the requirment is hard coded.