diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template
index 3e3f44ea01dedfcd02a47cfe9005ade71ddbea44_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..17f7ca0b4e68dcc3fe136a119455323a2a1bc0ba_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644
--- a/files/gitlab-config-template/gitlab.rb.template
+++ b/files/gitlab-config-template/gitlab.rb.template
@@ -521,6 +521,8 @@
 #     verify_certificates: true
 #     smartcard_auth: false
 #     active_directory: true
+#     smartcard_ad_cert_field: 'altSecurityIdentities'
+#     smartcard_ad_cert_format: null # 'issuer_and_serial_number', 'issuer_and_subject' , 'principal_name'
 #     allow_username_or_email_login: false
 #     lowercase_usernames: false
 #     block_auto_created_users: false
@@ -542,6 +544,8 @@
 #     verify_certificates: true
 #     smartcard_auth: false
 #     active_directory: true
+#     smartcard_ad_cert_field: 'altSecurityIdentities'
+#     smartcard_ad_cert_format: null # 'issuer_and_serial_number', 'issuer_and_subject' , 'principal_name'
 #     allow_username_or_email_login: false
 #     lowercase_usernames: false
 #     block_auto_created_users: false
diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb
index 3e3f44ea01dedfcd02a47cfe9005ade71ddbea44_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..17f7ca0b4e68dcc3fe136a119455323a2a1bc0ba_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644
--- a/files/gitlab-cookbooks/gitlab/attributes/default.rb
+++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb
@@ -301,6 +301,8 @@
 default['gitlab']['gitlab_rails']['ldap_sync_ssh_keys'] = nil
 default['gitlab']['gitlab_rails']['ldap_sync_time'] = nil
 default['gitlab']['gitlab_rails']['ldap_active_directory'] = nil
+default['gitlab']['gitlab_rails']['ldap_smartcard_ad_cert_field'] = nil
+default['gitlab']['gitlab_rails']['ldap_smartcard_ad_cert_format'] = nil
 ####
 
 default['gitlab']['gitlab_rails']['smartcard_enabled'] = false
diff --git a/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb
index 3e3f44ea01dedfcd02a47cfe9005ade71ddbea44_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvZ2l0bGFiLnltbC5lcmI=..17f7ca0b4e68dcc3fe136a119455323a2a1bc0ba_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvZ2l0bGFiLnltbC5lcmI= 100644
--- a/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb
+++ b/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb
@@ -791,6 +791,8 @@
     ## EE only
     group_base: <%= quote(@ldap_group_base) %>
     admin_group: <%= quote(@ldap_admin_group) %>
+    smartcard_ad_cert_field: <%= quote(@ldap_smartcard_ad_cert_field) %>
+    smartcard_ad_cert_format: <%= quote(@ldap_smartcard_ad_cert_format) %>
     sync_ssh_keys: <%= quote(@ldap_sync_ssh_keys) %>
     sync_time: <%= @ldap_sync_time %>
   <% end %>
diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails/gitlab_yml/ldap_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails/gitlab_yml/ldap_spec.rb
index 3e3f44ea01dedfcd02a47cfe9005ade71ddbea44_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMvZ2l0bGFiX3ltbC9sZGFwX3NwZWMucmI=..17f7ca0b4e68dcc3fe136a119455323a2a1bc0ba_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMvZ2l0bGFiX3ltbC9sZGFwX3NwZWMucmI= 100644
--- a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails/gitlab_yml/ldap_spec.rb
+++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails/gitlab_yml/ldap_spec.rb
@@ -20,6 +20,8 @@
           password: nil,
           port: nil,
           prevent_ldap_sign_in: false,
+          smartcard_ad_cert_field: nil,
+          smartcard_ad_cert_format: nil,
           sync_ssh_keys: nil,
           sync_time: nil,
           uid: nil,
@@ -55,4 +57,5 @@
                   encryption: 'plain',
                   bind_dn: 'dc=example,dc=com',
                   password: 's3cr3t',
+                  active_directory: true,
                   smartcard_auth: 'required',
@@ -58,4 +61,6 @@
                   smartcard_auth: 'required',
+                  smartcard_ad_cert_field: 'extendedAttribute1',
+                  smartcard_ad_cert_format: 'rfc822_name',
                   base: '',
                   user_filter: '',
                 }
@@ -87,4 +92,5 @@
                 encryption: 'plain',
                 bind_dn: 'dc=example,dc=com',
                 password: 's3cr3t',
+                active_directory: true,
                 smartcard_auth: 'required',
@@ -90,4 +96,6 @@
                 smartcard_auth: 'required',
+                smartcard_ad_cert_field: 'extendedAttribute1',
+                smartcard_ad_cert_format: 'rfc822_name',
                 base: '',
                 user_filter: '',
               }
@@ -113,6 +121,8 @@
               ldap_method: 'plain',
               ldap_bind_dn: 'foobar',
               ldap_active_directory: 'asdf',
+              ldap_smartcard_ad_cert_field: 'extendedAttribute2',
+              ldap_smartcard_ad_cert_format: 'subject',
               ldap_allow_username_or_email_login: false,
               ldap_lowercase_usernames: true,
               ldap_group_base: 'dc-example.com',
@@ -127,6 +137,8 @@
           expected_output = {
             enabled: true,
             prevent_ldap_sign_in: false,
+            smartcard_ad_cert_field: 'extendedAttribute2',
+            smartcard_ad_cert_format: 'subject',
             sync_time: 10,
             host: 'primary.ldap',
             port: 389,