When using x509 certificates for authentication, I understand that there is a shared source of trust (the signing certificate authority). So that explains why a server is able to authenticate the client with a certificate.
But once the server says "yes I trust you because of your certificate", how can it distinguish who the certificate bearer is?
For instance, with username/password once the server authenticates the password it can use the username part to know who it is and what this client is authorized to do.
What is the "username" identifier in the certificate authentication scenario?