cermPolicyApplyUserOrGroupFlag 1.3.6.1.4.1.9.9.510.1.3.5.1.2

This is a flag indicating whether the cermPolicyApplyUserOrGroupName is a resource user name or resource group name. For resource group name, this object has to be set to 'group'.