Smartcard Authentication only

Question

Hello,

we have an internal PKI-setup and are using SmartCards for many administrative tasks. Our IT-security department has asked us to implement Smartcard-Authentication on one of our Adaxes-Portals. This portal should not support password-based logins.

To accomplish this we

- configured "Client Certificate Mapping Authentication" in IIS
- set "Active Directory Client Certificate Authentication" to enabled in IIS
- set the SSL-settings on the web site to "Require SSL" and "Require Client Certificate" in IIS

ASP.NET Impersonation authentication is the only authentication method that is enabled under "Authentication"

Connecting to the portal with smartcard works fine in general. When we connect, we are presented a smartcard prompt and once we choose the correct certificate we are logged on automatically (SSO).

Unfortunately we are seeing the following issue: If we chose to logoff from Adaxes using the logoff option on the top right-hand side in the browser we are taken back to a username / password dialog box. When we type in a valid username and password we are authenticated again - but we don't want that. We need to be able to enforce SmartCard authentication only. User should not be allowed to type in their usernames and passwords.

Could you please advise what we could do?

Thank you very much!
HarryNew

Comments

Hello Harry,

Could you specify, what version of Adaxes you are currently using? To check that:

1. Launch Adaxes Administration Console.
2. In the Console Tree, right-click your service.
3. In the context menu, click Properties.
   
4. Adaxes version will be displayed on the General tab.
   

---

Hello,

thank you for your answer. Our version is

3.8.14823.0

Regards
HarryNew

Answer 1

Hello Harry,

Thank you for specifying.

Unfortunately, there is no possibility to avoid displaying the sign in page after users sign out from a Web Interface. If you want to disallow users to sign in using their usernames and passwords, you need to enable the Smart card is required for interactive logon Account Option for the users.

For details on updating property values of AD objects, have a look at the following help article: https://www.adaxes.com/help/?HowDoI.Man ... rties.html.