regex to get username from certificate subject

hi out there I have a problem in getting the syntax correct for getting the username from the certificate in a apm policiy where I have added a custom expression in the visual editor and added a message box before where I can see that my subject gets correctly assigned

Valid Certificat - subject is CN=John Doe,OU=UserOU,DC=testdom,DC=dk but when I try to extract the username here I don't get syntax correct - I have tried several - lastly apm policy agent variable-assign /Common/pwless_auth_act_variable_assign_ag { variables { { expression "regexp {^CN\=(.+.+).*} \"[mcget {session.ssl.cert.subject}]\"" varname session.logon.last.username } } } help - any suggestions?

best regards /ti