EPM System provides com.hyperion.css.sso.agent.X509CertificateSecurityAgentImpl to extract the user identity (DN) from x509 certificates.
If you must derive user identity from an attribute in the certificate other than DN, you must develop and implement a custom login class similar to com.hyperion.css.sso.agent.X509CertificateSecurityAgentImpl, as described in this appendix.