Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a win 2008 server IIS7 and users who login with a CAC card. I want to add the user's CAC card user name to the web page when they login. And I'd also like to log user info from CAC card to my web server so I can see who's visiting my web site.

share|improve this question

migrated from stackoverflow.com May 6 '12 at 20:31

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers

If client certificates are enabled (Web Site > SSL Settings > Client Certificates > Accept), when the user authenticates with their smart card, the certificate is present as part of the Request object. You can retrieve it using Subject property the ClientCertificate.

if (Request.ClientCertificate.IsPresent)
{
    X509Certificate2 clientCertificate = new X509Certificate2(Request.ClientCertificate.Certificate);
    Debug.WriteLine("Subject: {0}", clientCertificate.Subject);
    Debug.WriteLine("Issuer: {0}", clientCertificate.Issuer); 
    Debug.WriteLine("Valid Until: {0}", clientCertificate.NotAfter.ToString("yyyy-MM-dd HH:mm"));
    Debug.WriteLine("Valid From: {0}", clientCertificate.NotBefore.ToString("yyyy-MM-dd HH:mm"));
    Debug.WriteLine("Serial Number: {0}", clientCertificate.SerialNumber);
    Debug.WriteLine("Thumbprint: {0}", clientCertificate.Thumbprint);
    Debug.WriteLine("Public Key: {0}", clientCertificate.GetPublicKeyString());
}
share|improve this answer
    
I think he needs the Common Name pulled from the certificate. I'm looking at mine right now and that's the only place I see my name. –  Joseph Kern May 7 '12 at 0:22
add comment

You want IIS7 to require SSL Client Certificates, this is why users need to make certificates available to windows through their card reading software, the browser passes the certificates from the card to IIS7.

  1. Open IIS Manager and navigate to the level you want to manage.
  2. In Features View, double-click SSL Settings.
  3. Make sure that you are at the site, application, or directory level
  4. On the SSL Settings page, select Require SSL.
  5. On the SSL Settings page, in the Client certificates area select: Require to require client certificates.

These are abbreviated instructions from technet.

This in combination with Gregs answer should be enough to get you started.

I would also run this by your legal team to see if you can log the connections, you may need to put a consent to monitoring preamble on the page.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.