We are in the process of securing our internal servers and there is a requirement of using two factor authentication (SSL client&server certificates and username-password).
One doubt that has come to my mind is if, when enforcing multiple factor authentication, the different factors must be relationed to each other when it is possible.
For example, if I know that some client system will have certificate X and username Y, should I reject a petition that comes with certificate X and username Z (which is valid but would be associated with another system that has certificate K)?
UPDATE: Since I see that the current answers talk about end users (browsers and certificate cards), I would like to emphasize that the communication is between several servers; the users are application users.
I have been browsing through Apache's modules1 and I do not see any straightforward way of implementing, so I do not know if my idea is just not part of the standard implementations and a bit too strict, or I am missing something.
1Admittedly, not my speciality.