I've finally managed to get my SharePoint system up and running so that it authenticates users with Kerberos and successfully passes that authentication along to a back-end WCF service. All end-users and the SP accounts are in the same domain; the WCF service is running as Network Service.
The back-end service is logging the claims present in every request, and shows claims for
authenticationinstant. However, I'm told it will also require a
upn claim containing the user's UPN.
How can I get this to happen? I've tried playing with the External System settings in SPD, and changing the web.config for the WCF service. (The service isn't under my control, but they've provided a copy for me to play with and I'll be feeding back any necessary changes.) Nothing seems to affect the list of claims, except when I screw it up enough that the request starts coming from one of the SP domain accounts rather than the user.