One to one SSL Mapping

In FirePass, you can add "Client Cert Check" in Pre-logon sequence.

 

Users > Endpoint Security > Pre-Logon Inspection > Client Certificates

 

 

And edit the rule to match something in the current session variables. (e.g if you have a specific CN name that matches some of the unique user session variables).

 

 

I haven't tested, though =)