Using SSL Client Authentication with SecurID Access IWA running on IIS

• • IWA Application With IIS and Windows Authentication
  • Generate the Necessary SSL Certificates
    • Creating SSL certificates for SSL Client Authentication with makecert
    • Creating SSL certificates for SSL Client Authentication with openssl
  • Importing the SSL Certificates
    • Import CA Certificate on the Web Server into the Trusted Root Certification Authorities Store
    • Import the Server Certificate on the Web Server into the Computer Account Personal Certificate Store
    • Import CA Certificate on the Client Machine into the Current Users Trusted Root Certification Authorities Store
    • Import Client Certificate on the Client Machine into the Current User's Personal Certificate Store
  • Configure IWA ASP application to use SSL Client Authentication
    • Enable SSL Client Authentication method on the IIS server
    • Import The Server Certificate into IIS and Enable HTTPS binding with the Imported Server Certificate
    • Enable SSL Client Authentication on the IWA ASP Application
    • Add One to One Mapping for the Certificate and the User
  • Testing out SSL Client Authentication
  • Troubleshooting SSL Authentication with IIS and ASP

IWA Application With IIS and Windows Authentication

Since our IWA connector runs as an ASP application on IIS, we can utilize the IIS SSL Client Authentication method to log users in. By default if you visit the IWA application (which by default uses Windows Authentication) on a machine that is not joined to the domain you will see a password prompt that will ask you for your AD password:

Let's see if we can enable SSL Client Authentication on the IWA ASP application in IIS to see if we can skip that password prompt.

Generate the Necessary SSL Certificates

There are couple of approaches to this: on windows we can use makecert and on linux we can use openssl.

Creating SSL certificates for SSL Client Authentication with makecert

There are actually a couple of sites that go over the setup:

• IIS 7 and Client Certificates
• How to create an IIS website that requires client certificate using self-signed certificates
• Creating self signed certificates with makecert.exe for development
• Testing with client certificate authentication in a development environment on IIS 8.5

First download the necessary tools, the above sites provides the links to download makercert and pvk2pfx. Next create a self signed CA with the makecert and create a pfx from the newly generated files with pvk2pfx:

Next we can create the Server SSL certificate and sign it with the newly created CA (and combine the files into one pfx file):

Lastly let's create the client SSL certificate and sign it with the same CA (and combine the files into a single pfx file):

That should be it for the cert generation.

Creating SSL certificates for SSL Client Authentication with openssl

We can follow a similar process as with makecert. First let's create a self signed CA:

Now let's create the Server Certificate and sign it with our CA:

And lastly let's create the client cert:

That should be it for the certificate creation on a Linux OS with openssl. A couple of notes, the srl file will contain the serial value of the last signed cert:

Also for comparison you can check out the purpose of the server cert and client cert:

Here is the client one:

For fun here are the ones created by makecert (in DER format):

And here is client one:

At this point just copy all the PFX files to the windows server running IIS.

Importing the SSL Certificates

I just ended up using the certs generated with the makecert and pvk2pfx utilities. For the Certificate imports we can break it down into four parts:

• Import CA Certificate into the Web Server's Computer Account Trusted Root Certification Authorities store
• Import the Server Certificate into the Web Server's Compunter Account Personal Certificate store
• Import the CA Certificate into the Client Machine's Current User Trusted Root Certification Authorities store
• Import the Client Certificate into the Client Machine's Current User Personal Certificate store

Import CA Certificate on the Web Server into the Trusted Root Certification Authorities Store

To import the certificate we need to launch the Certificates Snap-In. Go to Start -> run -> mmc and then click on to the
Add/Remove Snap In option:

Then choose the Certificates Snap-In and pick the Computer Account:

And then choose Local Computer:

Then under the Trusted Root Certification Authorities store import the CA Cert:

After it's imported you can confirm the cert is there:

Import the Server Certificate on the Web Server into the Computer Account Personal Certificate Store

From the same certificate snap-in import the Server Certificate into the Personal Certificate store. After it's imported confirm it's able to see the CA that signed it:

Import CA Certificate on the Client Machine into the Current Users Trusted Root Certification Authorities Store

I was using a windows 10 machine, so I launched the cert manager (Start -> run -> certmgr.msc):

And then import the CA certificate into the Trusted Root Certification Authorities Store and after it's done you will be able to see it:

Import Client Certificate on the Client Machine into the Current User's Personal Certificate Store

In the same Certificate Manager import the Client Cert under the Personal Store and confirm it's signed by the correct CA:

You can also launch chrome and confirm the cert is present:

Now let's go to the next section.

Configure IWA ASP application to use SSL Client Authentication

This can be broken down into a couple of parts:

1. Enable SSL Client Auth method on the IIS server
2. Import The Server Certificate into IIS and Enable https binding with the Imported Server Certificate
3. Enable SSL Client Authentication on the IWA Application
4. Add One to One Mapping for the Certificate and the User

Let's go into each step

Enable SSL Client Authentication method on the IIS server

Launch the Server Manager and under Roles scroll down to the IIS role and click on Add Role Services

Then scroll down and enable the IIS Client Certificate Mapping Authentication option:

After it's installed you will see a success message at the end:

Import The Server Certificate into IIS and Enable HTTPS binding with the Imported Server Certificate

Start the IIS Manager (Start -> Run -> inetmgr) and under the Server Section click on the Server Certificates Module:

Then click Import (under the Actions section) and import the Server Certificate:

Then at the Default Site Level click Bindings and enable HTTPS with the uploaded certificate:

Enable SSL Client Authentication on the IWA ASP Application

Now at the Application level launch the SSL Settings module:

and set the Client Certificates to Required and click Apply:

You can also set it to Accept, that way only the browser has a cert will it use, else it will keep using Windows Authentication:

Add One to One Mapping for the Certificate and the User

Now let's map our certificate to a username and password. At the Application Level or the Site Level, I only had one application so I did it at the site Level, launch the Configuration Editor Module:

In the Section field enter system.webServer/security/authentication/iisClientCertificateMappingAuthentication (that will list the options available for that feature) and enable it:

Then click on oneToOneMappings and click the ... to add a new one:

Then add a new user (for the certificate paste in a X509 Base64 encoded version of the client ssl certificate):

Also make sure the certificate is one big line, if you have a new line characters in the cert it will only paste the first line. Then close this dialog and you will see the Count value increase:

Then click Apply and it will save the settings:

That should be it for the IIS settings. For good measure go ahead and restart the IIS Server (Start -> Run -> iisreset)

Testing out SSL Client Authentication

Now just go to the Portal and click on the IWA icon and after you are forwarded to the IWA server it will prompt you for your Certificate. Here is how it looked like in Chrome:

After choosing the certificate, I was forwarded to the portal and I was successfully logged in. Here is how the prompt looked like on the IE Edge:

For IE 11 and lower you can set a setting to only prompt if you have more than one certificate. Launch internet options (Start -> Run -> inetcpl.cpl) and go to Security -> Internet -> Custom Level and under the Miscellaneous section you can enable the Don’t prompt for client certificate selection when only one certificate exists option:

That's should be it

Troubleshooting SSL Authentication with IIS and ASP

Here are some troubleshooting tips for this setup. First enable detailed errors for ASP Applications. This is a two step process, in IIS manager under the Application Section launch the ASP module and under the Debugging Properties set the Send Errors to Browsers to true:

Second, under the Error Pages module click on Edit Features Settings and in the Error Responses Section set it to Detailed Errors:

Then when you don't have the client SSL Certificate in the browser you will see this:

Without enabling that you will just see the following:

Another thing to check out is the Security Section in the Event Viewer (Start -> Run -> eventvwr):

I entered the wrong password under the mapping section and I saw the following event:

The failure reason can be looked up here and in my case FailureReason %%2313 is wrong password or username (found a forum on that)