First, I have very limited knowledge about AD.

Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will generate its own certificate via a CA. The CA is tied up with AD, so user authenticates on AD via certificates.

On the question is: Can a user account on AD hold multiple certificate for a single user. Because in my case the private key will not be share between devices (Devices will connect with CA to retrieve its own identity cert)

Please help


In the Microsoft / Active Directory world, there are several ways by which certificate-based authentication may happen, but the short answer is: yes, a user can have several certificates.

In IIS terminology, that is called "certificate mapping", with the option clientCertificateMappingAuthentication (not to be confused with iisClientCertificateMappingAuthentication). There are two methods by which a given client certificate can be mapped unto a user AD account:

  • The account in the AD may contain a copy of the certificate (not the private key) in its userCertificate attribute.
  • The AD server may extract the UPN from the validated client certificate and use that as account name.

Since the userCertificate attribute is multi-valued, it can contain several certificates, so this works with what you are looking for. The second kind of mapping can be intricate to set up (the AD server must also have a certificate of its own, and there is a complex game with the "enterprise NTAuth certificate store") but means that a virtually infinite number of certificates, not known in advance, can map to a given user account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.