Is there any specific reason why RBAC authenticated principle looking URI SAN and if it is not available looking at Subject? Would it be OK to check URI SAN or DNS SAN of Subject in that order? It would be useful for people who does not have URI SAN in the certs.

Relevant links :
Docs :
https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/rbac/v2/rbac.proto#config-rbac-v2-principal-authenticated

Code: