FIX: Default group of the identity DN

FIX: When checking default group of the first proxy step, use the cert issuer DN instead of the subject so we can get the real DN