Certificate format for PKINIT to Windows?

[Geoffrey Elgey <geoffree@vintela.com>]

G'day,

For those who have performed a successful PKINIT to a Windows server, 
can you provide information on the certificate values that are required 
for authentication?

For example, is an email address required? A UPN? What form does the 
subjectAltName take, etc? I haven't found any documentation on what 
certificate information is required for a successful PKINIT to a Windows 
KDC.

I feel I'm close to a successful Heimdal PKINIT to a Windows 2003 
server, if I can only create the appropriate certificate and assign the 
correct policy settings on the Windows server.

Any help appreciated.

-- Geoff