I have two accounts on the system:

mccannwj:x:729:128:William Jon McCann:/home/mccannwj:/bin/bash
mccann:x:730:730::/home/mccann:/bin/bash

% pkcs11_inspect
Printing data for mapper digest:
5D:0F:C5:B6:52:C9:CC:EF:EA:4D:16:5C:3C:30:64:B4:90:60:D0:41
Printing data for mapper uid:
mccann
Printing data for mapper cn:
William Jon McCann
Printing data for mapper pwent:
William Jon McCann
Printing data for mapper mail:
mccann
mccann
Printing data for mapper subject:
UID=mccann,CN=William Jon McCann,E=mccann,O=Token Key User


So, currently the default mapper looks for CN before UID.  There are two
problems with this.

1. I can log into either the mccann or mccannwj account from console login
2. By default, gdm chooses the mccannwj user instead of the mccann user