In the Microsoft / Active Directory world, there are several ways by which certificate-based authentication may happen, but the short answer is: yes, a user can have several certificates.
In IIS terminology, that is called "certificate mapping", with the option clientCertificateMappingAuthentication (not to be confused with iisClientCertificateMappingAuthentication). There are two methods by which a given client certificate can be mapped unto a user AD account:
- The account in the AD may contain a copy of the certificate (not the private key) in its
- The AD server may extract the UPN from the validated client certificate and use that as account name.
userCertificate attribute is multi-valued, it can contain several certificates, so this works with what you are looking for. The second kind of mapping can be intricate to set up (the AD server must also have a certificate of its own, and there is a complex game with the "enterprise NTAuth certificate store") but means that a virtually infinite number of certificates, not known in advance, can map to a given user account.