Geek Answers Handbook

Secure ASP.NET MVC application with SSL and client certificate validation

I want to protect an ASP.NET MVC application with SSL and client certificate authentication. I am using IIS 7.5, Windows Server 2008 R2.

I would like to know if the following can be done via Web.config (it should be there!)

  • Require SSL for all requests
  • Mapping multiple client certificates to one user
  • Require user authentication

In addition, any pointers to how to do this, any tutorials or other relevant resources will be highly appreciated as I am new to almost all of these things.

+7
source share
2 answers

So, to answer my own questions .. all of the above can be achieved using Web.config. The next section of Web.config requires SSL through the System / Access section and configures one-to-two client certificate mapping. These sections are locked in applicationHost.config, so anyone who wants to edit them in Web.config will need to unlock them. There are many tutorials on this, so I won’t go into it.

<security> <access sslFlags="Ssl, SslNegotiateCert" /> <authentication> <anonymousAuthentication enabled="false" /> <iisClientCertificateMappingAuthentication enabled="true" manyToOneCertificateMappingsEnabled="true"> <manyToOneMappings> <add name="Authentication Certificate" enabled="true" permissionMode="Allow" userName="foo" password="bar"> <rules> <add certificateField="Issuer" certificateSubField="CN" matchCriteria="*.stackoverflow.com" compareCaseSensitive="false" /> </rules> </add> </manyToOneMappings> </iisClientCertificateMappingAuthentication> </authentication> </security>
+7
source

Order:

  • Require SSL for all requests - Yes. In IIS, only install the site with the https binding and remove the http binding. The site will not respond to HTTP requests. If you do, you must create a script to redirect 403.4 errors from http://mysite.com to https://mysite.com . You can find many examples of how to do this using various tools.

  • Map multiple client certificates to one user - I don’t know. I will pass this one.

  • Require user authentication - Yes. In the web.config file in the <system.web> element, add the following:

      <authorization> <deny users="?"/> </authorization>
+2
source

More articles:


All Articles