We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login.
Besides those credentials, we want to add more security for accessing that web app with this requirement:
A user will access that web app only from its PC. If user goes to other place and uses other PC, then he/she will not be able to access that web app.
Our question is:
IF:
- A client-side certificate stored in the user's PC
- IIS is configured to accept client side certificates
THEN:
The user can access the web app only from that PC. If the user uses a different PC in which there is no client-side certificate, then user will not access web app.
Is that correct?