The CDAS approach is listed as being deprecated and will be removed in future releases. In any case - the documentation isn't really helpful when it comes to explaining how this works - a lot of words are used, but very little meaning can be gleaned from those words. It would be worth popping over to Philip Nye's blog for some insight.
Like almost everything you may want to achieve in the world of IVIA, there are probably multiple ways to deal with your use case. I've previously enabled client certificate authentication by writing an Infomap and, in effect, using the EAI approach. Again, Philip's blog probably details how you can do this - but be careful, later versions of IVIA (i.e., v11) require some additional configuration.
Personally? I like the Infomap approach - I can understand the code! But I've never executed a performance test to see if EAI is better than CDAS (or vice versa). It might be interesting to hear the thoughts from Product Management on that?
I think your question, however, is interesting. It highlights that there is a fundamental problem with the product documentation. As an example, the following text is lifted straight from the product documentation explaining client certificate mapping:
When data is requested from a resource manager, the granularity of the XML data returned is at the level of a single container of information. The container is normally also the smallest data element (for example, elements that might be considered for billing purposes). This convention also applies to the UMI XML model. The UMI that is used in user mapping rules is also defined and manipulated as containers of XML data. For example, the stsuuser:STSUniversalUser XML object defined in XML certificate model is an example of a UMI container.
For most mere mortals, they will be able to read this and understand the individual words. Beyond that, though, they will struggle because the documentation fundamentally excludes context. In fact, if you read the documentation from Introduction through to "Configuring WebSEAL", you may end up more confused than you were prior to even asking the question.
I've mentioned it before, but the best bet is to look up some previous example within the Community web pages; or take a look at Philip's excellent blog. Just be careful - many of the configuration examples are "version" specific.