draining the world\’s beer supply one pint at a time

Lets say that you don’t really want users to login, just have a valid certificate.  All your Windows boxes do auto-enrollment and get certificates.  This works transparently.
Macs however…  well, lets just say it took a while to realise that the certificate common name should be the UPN, not the username and not the email address.  Now it works just fine   Needless to say, this was a problem with the certificate server’s templates, not with the mac itself.