Ask a questionAsk a question
 

AnswerISA 2006 Reverse proxy and user (x.509) certificates

  • Friday, October 16, 2009 8:55 PMIan Brogden Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    We need to publish an internal system that will require a user (x.509) certificate for authentication.

    Is there anything special we need to do on the ISA publishing rule to ensure the requests/responses for the user certificate get passed appropriately?

Answers

  • Sunday, October 18, 2009 8:13 AMKent Nordström Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    If the web app is requiring cert based auth you need to do non-web publishing of HTTPS server.
    You cannot bridge the SSL since ISA do not have access to users private key material.

    If possible try to see if the web app can be changed to Kerberos auth.
    Then if all requirements are ok (ISA is member of same domain as web app server being one) you could use bridging so that ISA authenticates the user based on certificate and delegates Kerberos to the web app.

All Replies

  • Sunday, October 18, 2009 8:13 AMKent Nordström Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    If the web app is requiring cert based auth you need to do non-web publishing of HTTPS server.
    You cannot bridge the SSL since ISA do not have access to users private key material.

    If possible try to see if the web app can be changed to Kerberos auth.
    Then if all requirements are ok (ISA is member of same domain as web app server being one) you could use bridging so that ISA authenticates the user based on certificate and delegates Kerberos to the web app.