Client Certificate Mapping and Delegation?

From: Steve Jansen (steve.jansen@nospam.byteinteractive.com)
Date: 03/05/03 

From: "Steve Jansen" <steve.jansen@nospam.byteinteractive.com>
Date: Wed, 5 Mar 2003 10:32:46 -0500

Hello,

Is it possible (supported or unsupported) to perform security delegation on
W2K/IIS 5 when authenticating visitors by client certificate mapping over
SSL?

Basically, I want the visitor to connect to a SQL Server instance (via
Windows authentication) using the credentials mapped to their certificate.
The SQL Server cluster is on the same AD domain, but, different machines
from the web server cluster. When connecting to SQL, I always receive
"Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'" error, which
generally occurs when the NT credentials are not passed or delegated over
Windows authentication.

I can get delegation to work via Kerberos with Windows Authentication (aka
Challenge/Response) in our development environment. I can also accomplish
this goal using Basic Authentication over SSL, as IIS has the plaintext
credentials.

I cannot get this to work using client certificate mapping, which is
unexpected as IIS has the username/password mapping credentials stored in
the metabase. Thus, I would expect IIS to be able either use the persisted
credentials, or delegate via a Kerberos ticket. 

--
-Steve Jansen
Byte Interactive

Relevant Pages

  • Re: IIS6 - Integrated Authentication Probs
    ... So I cant go the whole way with constrained delegation, ... > what makes it more secure that Basic authentication. ... >> credentials to authenticate with the target resource. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Integrated windows authentication and NetworkCredential
    ... if delegation is properly configured AND you are impersonating ... you can get a valid credential object via: ... Delegating user's credentials is one of the most often asked about, ... >> authentication in IIS. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • IIS Client Certificate Mapping and Windows 2000 Delegation to SQL
    ... Is it possible to perform security delegation on ... W2K/IIS 5 when authenticating visitors by client certificate mapping over ... Windows authentication) using the credentials mapped to their certificate. ...
    (microsoft.public.inetserver.iis.security)
  • Re: shared folder access
    ... Your first option is to use Basic Authentication in IIS over SSL. ... This will remove the UNC user token credentials (something that cannot be ... Doing so causes IIS to attempt delegation using ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Default credentials
    ... > comes up on my client site requires NTLM or Basic authentication? ... > a web browser - I assume it must be something they have set up ... If your receive a Dialog asking for your creds with NTLM auth ... credentials of the current security context. ...
    (microsoft.public.dotnet.framework.aspnet.webservices)