6

First, I have very limited knowledge about AD.

Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will generate its own certificate via a CA. The CA is tied up with AD, so user authenticates on AD via certificates.

On the question is: Can a user account on AD hold multiple certificate for a single user. Because in my case the private key will not be share between devices (Devices will connect with CA to retrieve its own identity cert)

Please help

1 Answer 1

6

In the Microsoft / Active Directory world, there are several ways by which certificate-based authentication may happen, but the short answer is: yes, a user can have several certificates.

In IIS terminology, that is called "certificate mapping", with the option clientCertificateMappingAuthentication (not to be confused with iisClientCertificateMappingAuthentication). There are two methods by which a given client certificate can be mapped unto a user AD account:

  • The account in the AD may contain a copy of the certificate (not the private key) in its userCertificate attribute.
  • The AD server may extract the UPN from the validated client certificate and use that as account name.

Since the userCertificate attribute is multi-valued, it can contain several certificates, so this works with what you are looking for. The second kind of mapping can be intricate to set up (the AD server must also have a certificate of its own, and there is a complex game with the "enterprise NTAuth certificate store") but means that a virtually infinite number of certificates, not known in advance, can map to a given user account.

1
  • For anyone coming across this answer in the future, clientCertificateMappingAuthentication is NOT enabled by default in IIS 7.0 and later. Scroll down on the Microsoft page that @TomLeek linked to and you can find instructions on how to enable it. Mar 7, 2022 at 22:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .