What not use a different naming convention or other OID available in the x.509 spec?
his is a long discussion. We were using /UID=username, but some OpenSSL versions reported the oid-to-name mapping inconsistently. Since this was casuing problems, TAGPMA encouraged us to change to a different scheme. We looked at other OID’s available along with appending additional /CN objects, and decided on /pseudonym=username as to to interfere with the original DN. However, due to inconsistencies in the BouncyCastle software used by much grid middleware, this was abandoned. We then had a shoot out of /CN=UID= and /CN=UID: and /CN=UID: had the least impact in the grid (BouncyCastle still had inconsistencies with /CN=UID=). There are countless different ways to handle this, including inventing our own OID, but it was decided to stick with something that supports the lowest common denominator while providing an easy to parse object to extract the Fermi username.
