I have an ADFS 2.0 server set up to use Smart Card authentication.
It works great if the user already exists in the AD, or isn't disabled.
Slight background, we operate an Active Directory forest that uses a third party PKI for user authentication. We don't have a trust to the original AD, just the PKI, so user accounts will be created on an as needed basis. There is the potential to have tens of thousands of users so we want the process to be self-serve.
When a person fails to log in (because of their account not existing or their account being disabled) there's two errors thrown, an event 364, which is always the same and event 111 which says either User name/password failure or account is disabled.
The error page seems to only pull (as far as I can tell) from event 364, which is tremendously unhelpful.
Is there any way to figure out WHY the user authentication fails during smart card log in?