I created self-signed root certificate, ssl certificate and client certificate using makecert util. I created site in IIS, enabled settings "Require SSL" and "Require client certificate". This site uses my ssl certificate. Then I installed client certificate on client PC and it works fine without any client certificate mappings. When it's required to configure mappings and when it's not needed?
Under the mapping, you can map individual users to tokens which can then have permission to see things or do tasks (Admins, Personnel, Customers, etc). Without that you're just testing to see if a user has a valid certificate regardless of who he is.
You can authenticate the users further using mechanisms like form authentication but the mapping can automate this task for you.