Heads up on Web-based certificate mapping

Here are a few pointers to watch out for when you're setting up Web sites that use client certificates for authentication.

1. If the site uses both login (Basic or NTLM) authentication and certificate mappings, then the login over-rides the certificate mapping.

2. There are two types of certificate mapping (as of IIS5). One is built into IIS and uses a strong comparison between the stored certificate credentials and the certificate presented by the user. However, any administrator of the server can enumerate all usernames/passwords of certificate mappings. If a certificate is renewed or replaced, it will need to be re-imported into IIS.

The second type of certificate mapping is done in Active Directory, however it uses a weak mapping ("subject" component of certificate) between the stored certificate credentials and the presented client certificate. This allows it to transparently support renewed or replaced certificates and no password information can be enumerated. However, if two certificates are requested from the same CA, using the same textual (name, e-mail, etc.) credentials, AD is unable to differentiate between them.

3. If you're using AD-based certificate mapping, to view the certificates, you'll need to turn on the advanced options in AD: Users and Groups and then right click a user and select the Name Mappings item.

Good luck and have fun with certificates.

Rate this Tip To rate tips, you must be a member of SearchEnterpriseDesktop.com. Register now to start rating these tips. Log in if you are already a member. Submit a Tip Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Microsoft Internet Explorer (IE) Admins can wear many hats using Netcat Patching third-party browsers adds more work in Windows shops Four Internet Explorer 8 Group Policy security settings Safe enterprise Web browsing: Five tips in five minutes Top client security tips of 2006 General security configuration: Step 1 Protection against international domain names, URL handling: Step 3 ActiveX opt-ins, information bar and cross-domain protection: Step 4 Windows Vista and IE7: Step 5 Phishing filter: Step 2 RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary ActiveX  (SearchEnterpriseDesktop.com) ActiveX control  (SearchEnterpriseDesktop.com) Internet Explorer  (SearchEnterpriseDesktop.com) Internet Explorer Administration Kit  (SearchEnterpriseDesktop.com) tabbed browsing  (SearchEnterpriseDesktop.com) RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.