X.509 Client Certificate and Basic Authentication Schemes

The X.509 Client Certificate and Basic authentication scheme combines Basic authentication and X.509 Client Certificate authentication. This authentication scheme provides an extra layer of security for critical resources.
sm1252sp1
The X.509 Client Certificate and Basic authentication scheme combines Basic authentication and X.509 Client Certificate authentication. This authentication scheme provides an extra layer of security for critical resources.
For a user to authenticate successfully, the following two events must occur:
  • The X.509 client certificate of the user must be verified.
  • The user must provide a valid user name and password.
For X.509 Client Certificate authentication, the Policy Server instructs the Web Agent to redirect the user to an SSL server and map the user’s certificate to the server. The Policy Server then verifies that the user exists, verifies the  basic credentials and confirms that certificate credentials and the basic credentials represent the same user.
2
X.509 Client Certificate and Basic Scheme Prerequisites
Verify that the following prerequisites are met before configuring an X.509 Client Certificate and Basic authentication scheme:
  • An X.509 Server Certificate is installed on the SSL Web server.
    sm1252sp1
    If the Policy Server is operating in FIPs mode, ensure the certificate was generated using only FIPS-approved algorithms.
  • The network supports an SSL connection to the client browser (HTTPS protocol).
  • X.509 client certificates are installed on client browsers.
  • Trust is established between client certificates and server certificates.
  • The certificate is issued by a valid and trusted Certification Authority (CA).
  • The issuing CA public key validates the   digital signature of the issuer.
  • Client and server certificates have not expired.
  • The   public key of the user validates the  digital signature of the user.
  • Client user name and password information exists in a user directory.
  • A directory connection exists between the Policy Server and the user directory.
For Apache Web servers where certificates are required or optional, the SSL Verify Depth 10 line in the httpd.conf file must be uncommented.
Configure an X.509 Certificate and Basic Authentication Scheme
Use an X.509 Certificate and Basic authentication scheme to combine certificate authentication and basic authentication.
sm1252sp1
The following procedure assumes that you are creating an object. You can also copy the properties of an existing object to create an object. For more information, see Duplicate Policy Server Objects.
sm1252sp1
Follow these steps:
  1. Click Infrastructure, Authentication.
  2. Click Authentication Schemes.
  3. Click Create Authentication Scheme.
    Verify that the Create a new object of type Authentication Scheme is selected.
  4. Click OK.
  1. Enter a name and a protection level.
  2. Select X509 Client Cert and Basic Template from the Authentication Scheme Type list.
  3. Enter the server name and target information for the SSL Credentials Collector.
  4. (Optional) Select Persist Authentication Session Variables in Scheme Setup. This option specifies that the authentication context data is saved in the session store.
  5. Click Submit.
    The authentication scheme is saved and can be assigned to a realm.