1. DelegateISE config changes are made, TPS CS. cfg has the following changes
as well
op.enroll.delegateISEtoken.keyGen.authentication.SANpattern=$auth.RFC822Name$
auths.instance.ldap1.ldapStringAttributes=mail,cn,uid,edipi,pcc,firstname,lastn
ame,exec-edipi,exec-pcc,exec-mail,certsToAdd,tokenCUID,tokenType,RFC822Name
2. The ldap entry looks as follows
dn: uid=delegate1,ou=People,dc=pki-tps1
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: top
objectClass: extensibleobject
cn: delegate1
sn: delegate1
uid: delegate1
givenName: delegate1
mail: johndoe@EXAMPLE.ORG
firstname: John
lastname: Doe
memberid: 7654321
catcode: AC
edipi: 123456789
edipi: 999999999
pcc: AA
exec-memberid: 1234567
exec-catcode: AC
exec-mail: exec1@EXAMPLE.ORG
userPassword:: e1NTSEF9NHBlTVJqNlN5WFY1QSs0WTVEdktKSXB0b3k4TEtUd2lmclpuNmc9PQ=
 =
tokenType: delegateISEtoken
certstoadd: 268435509,ca1,57,kra1
exec-edipi: 12345
rfc822name: delegate1@example.org
3. Enroll a token

The authentication cert on the token has the following
Identifier: Subject Alternative Name - 2.5.29.17
                    Critical: no
                    Value:
                        OtherName:
(UTF8String)1.3.6.1.4.1.311.20.2.3,$auth.RFC822Name