Great, thanks a lot Alexander, worked like a charm, placed gss.xml within DIR_EXECUTABLE kernel directory and now ABAP system takes SNC User Name as a SAN field of x.509 cert. However things are different if I'm accessing content via webdynpro (sapgui4html), SSO is only working if the table view VUSREXTID, with External ID type DN, is populated still with certificate's Subject Name contents, placing SUN there breaks SSO.
Is there a way to use UPN (SUN) also for SSO via webdynpro?