What problem are you trying to solve?

Focus on the what and why of the need you have, not the how you'd like it solved.

It should be possible to use x509 Auth without mapping every single subject attribute to the user. Currently the user can only authenticate once the secret and username 1:1 match. I would like to have the option to strip away attributes.

What would you like to see happen?

Describe the desired outcome or enhancement.

If a user has a certificate like:

CN=user01, OU=Clients, O=company1, C=CH

and inside the $external Database a user like this exsists:

CN=user01

The user should be able to authenticate (as long as his certificate is trusted and valid).

Why is this important to you or your team?

Explain how the request adds value or solves a business need.

Many tools already support this. If there is a change at the issuer the connection is broken (e.g. if a OU changed from "Example" to "Example Company").

What steps, if any, are you taking today to manage this problem?

Currently we use x509 Auth and hope that we will be able to update users befor a subject attribute changes.