Certificate authentication

[valery]

Hello,

I am working on the topic : assigning users to permission groups based on their certificates.
Concerning this matter, I would like to ask two questions

Question 1
----------
Chekpoint NG allows to define rules to match a user's certificate to a permission group based on fields in the certificate's DN.
Is it possible to do it based on an X509 V3 extension ? (Meening the firewall usergroup affiliation is written in the certificate as a V3 extension)


Question 2
----------
Is it possible to restrict the certificates used for the VPN authentication based on their KeyUsage (Digital Signature, Key Encipherment, Non-Repudiation etc...)


As far as I understand the Checkpoint documentation, I did not find any clue how to achieve this goal; how far is it possible to add functionalities to Checkpoint, is it possible to develop an Add-on/Module/Script to enable this functionality ?


Thanks in advance and best regards
Valery