In IIS 6 I was able to use the following technique:
- Turn on requirement for client certificates
- Using adsutil.vbs figure out what IUSR_Server user password is
- Create a one-to-one mapping of the certificate to the IUSR_Server account (that's why I need to know IUSR's password)
- Disable anonymous access to the site
Taking into account all the breaking changes in IIS 7.x, I assume that client certificate mapping now has to be created to the ApplicationPoolIdentity? In any case: to create a mapping, I need to specify userName and password, however for both IUSR and ApplicationPoolIdentity passwords don't seem to exist?
My goal is to prevent access to the site without a particular client certificate. At the same time I do not want to create a separate Windows user, configure the AppPool to use it for identity, and then set up one-to-one certificate mapping to this user. Instead, I want to rely on the existing identities offered by IIS. Any ideas?