Is the following the correct format for 1) pulling the common name from the directory server assuming support for doing so has been set up in the CA's CS.cfg. 2) Specifing the ou, o and c as parts of the subject? policyset.IDUserSet.1.default.params.dnpattern=cn=$request.auth_token.cn [0]$, ou=const1,ou=const2,ou=const3,O=const4,C=const5 If the common name is Sean.Veale the goal is so the subject looks like CN=Sean.Veale OU=const1 OU=const2 OU=const3 O=const4 C=const5 Thanks Sean