RE: Client certificate authentication

Jeffrey, You stated in the 1st reply that I should be able to validate the
the clients certificate. How do I do that ? When I called
QueryContextAttribute specifing SECPKG_ATTR_REMOTE_CERT_CONTEXT I get
SEC_E_NO_CREDENTIALS.
--
Timothy Jewett
Jewettware@xxxxxxxxxxxxx


""Jeffrey Tan[MSFT]"" wrote:

Hi Jewett,

Thanks for your feedback!

Yes, this is issue I talked about in the first reply. I have discussed this
issue with SSL expert and the original issue owner. They confirmed that
they are the same issue.

AcceptSecurityContext will set ASC_RET_MUTUAL_AUTH if a client certificate
was received from the client and schannel was successfully able to map the
certificate to a user account in AD. For this to occur, Certificate
Mapping must be performed by domain admin before.

Certificate Mapping is the process of mapping a client authentication
certificate to a domain user account in AD. This operation is done on the
domain controller of the AD domain either manually or programmatically
during installation by domain admin:
http://technet2.microsoft.com/WindowsServer/en/library/3f98fdd9-ed64-49f7-9c
20-a2d4581dfbea1033.mspx?mfr=true (Look for "How Schannel Uses Certificate
Mapping").

Mapping Certificates requirement is documented in "Authenticating the
client" in MSDN.
http://msdn2.microsoft.com/en-us/library/aa378819.aspx

The Certificate Mapping process is documented at [Section Using the Active
Directory for One-to-One Mapping]
http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/ac
tivedirectory/howto/mapcerts.mspx

The handshake succeeds even though cert mapping has failed. The return
value of QueryContextAttributes with SECPKG_ATTR_ACCESS_TOKEN will indicate
the reason for cert mapping failure.

Note: this also applies to x64 Win2003.

There are also 2 WebClient and WebServer samples in the PlatformSDK at
%MSSDK%\Samples\Security\SSPI\SSL. This is the folder structure if you have
Windows Server 2003 SP1 Platform SDK installed.

If you still have anything unclear, please feel free to tell me, thanks.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



.

Relevant Pages

  • RE: Web App With Signature
    ... use some rich client approach such as ACTIVEX control. ... retrieve protect resource on client(such as file system or certificate ... Microsoft MSDN Online Support Lead ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Client certificate authentication
    ... AcceptSecurityContext will set ASC_RET_MUTUAL_AUTH if a client certificate ... Mapping must be performed by domain admin before. ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.platformsdk.security)
  • RE: Client certificate authentication
    ... I would have liked the quick check to make sure the certificate was ... Mapping must be performed by domain admin before. ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.platformsdk.security)
  • RE: Certificate Mapping - Debugging
    ... Has his client certificate's private been properly exported and installed ... the CA which issues the client certificate must be trusted by ... you may install his client cert on your machine ... Microsoft Online Community Support ...
    (microsoft.public.inetserver.iis.security)
  • RE: Client certificate authentication
    ... "That means the client did not even send a certificate. ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.platformsdk.security)