I am trying to accompolish the same thing, one thing I have found the smart card username is not in the same format that a traditional username. The identifying information for a client certificate is in x.400 format so the user identifying data is generally the Subject of the certificate in the form of somthing like this.
CN="John Doe",OU=Users,DC=domain,DC=com
There can be other certificate attributes if you collect them at enrollment time like Common Name which is just the CN portion of the above string. To get this to work you would have to have the username directory Splunk uses match the username string to exactly what is passed via the REMOTE-USER string. The 2 ideas I have has was do an LDAP query of the user based on the subject string to get the samaccountname from LDAP (Active Directory) and pass that to splunk as the REMOTE-USER or to setup the LDAP stradegy in Splunk (The directory of usernames to check the REMOTE-USER against) to use the CN for the user name attribute. The issue I am finding is that the username in the format of john.doe or jdoe is just not a standard part of the certificate and you can only pass information to the REMOTE-USER variable that you have.
My fear with querying for the samaccountname is that SSO checks for every action so it will do alot of queries against LDAP. I have not been able to get this to work yet but this is what I have discovered so far in trying to get SmartCards to work.
... View more