I have actually implemented this and done extensive testing in regards to SmartCard authentication. There are things hinted at what it checks and how it works in Sam's link to the Microsoft KB article: http://support.microsoft.com/kb/281245
When you use a SmartCard certificate, most of the time the certificate attached to the SmartCard is generated ON the card and the private key cannot be exported. So using the same certificate on multiple cards may not work, unless it is generated outside the card then imported. Not all cards allow the key to be imported like that. However, you can issue multiple certificates that logon to the same account. All you have to make sure is the UPN on all the certificates match, even if the certificates are not the same.
Through experience and some of the technet/MSDN articles, Microsoft Active Directory checks the following things to see if they are true to allow access based upon the certificate provided by the SmartCard:
- Is the issuing CA trusted for certifying SmartCard logon?
- Is the issuing CA certificate valid (not expired, not revoked)?
- Is the SmartCard certificate issued by the trusted and valid CA?
- Is the SmartCard certificate valid (not expired, not revoked)?
- Does the User Principal Name on the certificate SubjAltName match the User Principal Name in Active Directory? Example: joesmith@ADDomain.com
- Can the Certificate Revocation List be positively retrieved as specified in the Smart Card certificate and the CA to confirm revocation status?
- Does the SmartCard certificate have a key usage of SmartCard Logon?
Once all the above are true, the SmartCard authentication will succeed.
You could even use one SmartCard to authenticate an unrelated or untrusted domain. For example, if a user with the Windows login of john.doe@domainA.com is issued with a SmartCard logon certificate for john.doe@domainA.com; John Doe can login to domainB.com even as Jane Smith so long as the Issuing CA is imported to domainB's AD properly as trusted for SmartCard issuance, and Jane Smith's account is set to be able to login with john.doe@domainA.com.
It is important to note that the Pre-Windows 2000 login format: DOMAIN\username is not used to authenticate SmartCard Certificates. So you can set the Pre-Windows 2000 login as one thing, while the UPN to another thing.
Finally, due to the above implications, in a higher security setting, the CA's practices are extremely important as forged authentication is easy if the CA is not controlled. As you can imagine, a CA that does not verify the identity of those requesting a certificate can issue duplicate certificates that allows others to impersonate a particular individual.