Validate User Organization
Registration does not correctly identify the organization that issued the CAC. This does not properly discriminate between users when they move between organizations, and does not allow dual persona personnel to have proper segmentation of access.
If the PIV ID in the Subject Alternative Name can be used, the PIV format for users is 10 characters for the Person Identifier, 1 character for the Organizational Category, 4 characters for the Organization Identifier, and 1 character for the Person/Organization Association Category. The following are regular expressions that extract that information.
(?<person_id>[0-9]{10})(?<org_category>[1-5])(?<org_id>[0-9A-Z]{4})(?<person_category>[1-7])
(?<person_id>[0-9]{10})(?<org_category>[1-5])(?<org_id>[0-9A-Z]{4})(?<person_category>[1-7])(?:@mil)
https://www.cac.mil/Portals/53/Documents/CAC_NG_Implementation_Guide_v2.6.pdf