User Quotas currently do not work for TLS users. The main issue is that the username in the Zookeeper paths is URL encoded. But we do not encode it. So where the right path should be /config/users/CN%3Dmy-user we just use /config/users/CN=my-user and the quotas are ignored.