The person a PA-S4U-X509-USER certificate names: the certificate this
realm's TLS client or enrollment Issuing CA issued, signed by it and not
revoked, carrying clientAuth and one urn:sts:person: name — the same
gate GET /tls/sign-in puts a presented certificate through
(common/tls_client_certificates.js's identityOf()).
The person a PA-S4U-X509-USER certificate names: the certificate this realm's TLS client or enrollment Issuing CA issued, signed by it and not revoked, carrying clientAuth and one
urn:sts:person:name — the same gateGET /tls/sign-inputs a presented certificate through (common/tls_client_certificates.js'sidentityOf()).