How can I add CAC user name to my web page and logging?

Question

I have a win 2008 server IIS7 and users who login with a CAC card. I want to add the user's CAC card user name to the web page when they login. And I'd also like to log user info from CAC card to my web server so I can see who's visiting my web site.

Answer 1

If client certificates are enabled (Web Site > SSL Settings > Client Certificates > Accept), when the user authenticates with their smart card, the certificate is present as part of the Request object. You can retrieve it using Subject property the ClientCertificate.

if (Request.ClientCertificate.IsPresent)
{
    X509Certificate2 clientCertificate = new X509Certificate2(Request.ClientCertificate.Certificate);
    Debug.WriteLine("Subject: {0}", clientCertificate.Subject);
    Debug.WriteLine("Issuer: {0}", clientCertificate.Issuer); 
    Debug.WriteLine("Valid Until: {0}", clientCertificate.NotAfter.ToString("yyyy-MM-dd HH:mm"));
    Debug.WriteLine("Valid From: {0}", clientCertificate.NotBefore.ToString("yyyy-MM-dd HH:mm"));
    Debug.WriteLine("Serial Number: {0}", clientCertificate.SerialNumber);
    Debug.WriteLine("Thumbprint: {0}", clientCertificate.Thumbprint);
    Debug.WriteLine("Public Key: {0}", clientCertificate.GetPublicKeyString());
}

Answer 2

You want IIS7 to require SSL Client Certificates, this is why users need to make certificates available to windows through their card reading software, the browser passes the certificates from the card to IIS7.

1. Open IIS Manager and navigate to the level you want to manage.
2. In Features View, double-click SSL Settings.
3. Make sure that you are at the site, application, or directory level
4. On the SSL Settings page, select Require SSL.
5. On the SSL Settings page, in the Client certificates area select: Require to require client certificates.

These are abbreviated instructions from technet.

This in combination with Gregs answer should be enough to get you started.

I would also run this by your legal team to see if you can log the connections, you may need to put a consent to monitoring preamble on the page.