User with more than 20 characters can not login to DSfW domain

When a user name has more than 20 characters the user cannot login (>20 bytes).
Normally the samaccountname and CN will match.  When the cn more than 20 characters the samaccountname is modified.
The samaccountname has strange characters

Example of a samaccountname when the cn is 20 characters or more.
cn: abcdefghijklmnopqrstup
sAMAccountName: $081000-E436KS948THM

#userprincipalname script
##################################################
#!/bin/bash

function skip_multivalued_cns ()
{
    echo
    echo "Searching for objects with multi valued CNs"
    echo "Such objects will not be updated"
   
    unlink /var/opt/novell/xad/log/multivalued_cns.log

    awk '
    BEGIN     { count = 0 }
    /dn: / { count = 0; dn = $2 }
    /cn: /  { ++count }
    /^$/    { if ( count > 1 ) print count,dn }
    ' $tmpfile1 > /var/opt/novell/xad/log/multivalued_cns.log

    if [ ! -s /var/opt/novell/xad/log/multivalued_cns.log ]
    then
        return 0
    fi

    echo
    echo "Objects with multi valued CNs found"

    declare -i cnt=0
    for i in "`cat /var/opt/novell/xad/log/multivalued_cns.log`"
    do
        cnt=`echo $i | awk '{print $1}'`
        dn=`echo $i | awk '{print $2}'`
        if [ "X$dn" = "X"]
        then
            continue
        fi
        echo
        if [ $cnt -eq 0 ]
        then
            echo "Ignoring $dn as CN attribute is missing"
        else
            echo "Ignoring $dn as CN attribute is multivalued"
        fi
        sed -i -e "/dn: $dn/,/^$/d" $tmpfile1
    done
}


dnsdomain=`/usr/bin/ldapsearch -x -b "" -s base dnsdomain | grep -i 'dnsdomain: ' | awk '{print $2}'`

if [ "X$dnsdomain" = "X"]
then
    echo "DNS domain information missing"
    exit
fi
echo "DNS Domain Name : $dnsdomain"

defaultnamingcontext=`/usr/bin/ldapsearch -x -b "" -s base defaultnamingcontext | grep -i 'defaultnamingcontext: ' | awk '{print $2}'`

if [ "X$defaultnamingcontext" = "X"]
then
    echo "Default Nmaing Context information missing"
    exit
fi
echo "Default Naming Context : $defaultnamingcontext"

export LDAPCONF=/etc/opt/novell/xad/openldap/ldap.conf

tmpfile1=`mktemp`
tmpfile2=`mktemp`

echo
echo "exporting all the users not having the userprincipalname attribute to $tmpfile1"
/usr/bin/ldapsearch -Q -LLL -Y EXTERNAL -b ${defaultnamingcontext} '(&(objectclass=user)(!(userprincipalname=*)))' dn cn > $tmpfile1
if [ $? -ne 0 ]
then
    "Exporting of users not having userprincipalname attribute failed"
    exit
fi

# skip multi-valued DNs
skip_multivalued_cns

grep -i -e 'cn:\|dn:' $tmpfile1 > /dev/null 2>&1
if [ $? -ne 0 ]
then
    echo
    echo "The final object list is empty. Nothing to update."
    exit 0
fi

echo""
echo "Generating a $tmpfile2 ldif file to populate the userprincipalname attribute"

sed -e "s/cn: \(.*\)/replace: userprincipalname\nuserprincipalname: \1@$dnsdomain/g" $tmpfile1 > $tmpfile2

echo "" | tee -a /var/opt/novell/xad/log/userprincipalname.log
echo "`date +"%b %d %Y %H:%m:%S"` Starting setting of userprincipalname attribute ..." | tee -a /var/opt/novell/xad/log/userprincipalname.log
echo "Executing $tmpfile2 ldif file ..." | tee -a /var/opt/novell/xad/log/userprincipalname.log
 
/usr/bin/ldapmodify -Y EXTERNAL -f $tmpfile2 2>&1 | tee -a /var/opt/novell/xad/log/userprincipalname.log
if [ $? -ne 0 ]
then
    echo 'Setting userprincipalname attribute failed'
    echo 'Check /var/opt/novell/xad/log/userprincipalname.log file for more details'
    exit
fi

unset LDAPCONF