So when the client logs in the username they type in is disregarded and the ASA instead uses the one that is part of their client certificate. This means that the attacker would have to know in ...