How to authenticate a user with the "Interactive Logon Smartcard" installed?
http://support.microsoft.com/kb/892424
When "Smartcard is required for interactive logon" is installed in Active Directory, it generates a random password. How do I use a smart card to authenticate a user via LDAP from a web application?
How do I know who the user is? Is there a way to access the certificate? Can I get it from the session?
a source to share
For this, HTTPS and SSL authentication should be used, since the client already has at least a certificate with a CA certificate on their smart card.
If only server authentication is used instead of SSL authentication, the client certificate is also validated by the server, not just the server certificate by the client (which is a more common setting, for example, e-commerce sites that support HTTPS). And you still get an encrypted connection as a bonus.
See Tomcat 6.0 SSL HOW-TO Configuration . The key point is the presence of the CA certificate in the trust-store attribute and the clientAuth attribute is true.
The login autoresponder must also be specified by CLIENT-CERT in the web.xml of the corresponding web application:
...
<login-config>
<auth-method>CLIENT-CERT</auth-method>
<realm-name>Foo * Bar * Realm</realm-name>
</login-config>
...
The SubjectDN attribute from the client certificate is used to identify the user. LDAP (or ActiveDirectory) can still be used for authorization. checking if the user belongs to the group.
It can be tricky to fix all of this the first time around. To get familiar with all the concepts, I recommend the following approach:
- Use BASIC auth-method with usernames and passwords stored in a file
- Use simple role-based authorization
- Enable CLIENT-CERT auth method + Simple Role Based Authorization
- Enabling LDAP for Role Verification
a source to share