The difference between the two options lies in if the Certificate CN field User (demoUser1 in our example) exists in the MarkLogic Server Security database as an internal user versus if the user retrieved from the Certificate Subject field is mapped as an external name to any existing user.