VPN Client endpoint authorization rules with client certificates

So it seems the authorization rules configuration in Client VPN endpoint wants to specify group ID (membership) from SAML claims. But what if users are authenticated using client certificates? Cannot use custom fields?