Federation Security Services Guide › Federation Web Services Application Setup › Protect the Federation Web Services Application › Protect the Assertion Retrieval or Artifact Resolution Service (optional) › Use a Client Cert. to Protect the Assertion Retrieval or Artifact Resolution Service

Use a Client Cert. to Protect the Assertion Retrieval or Artifact Resolution Service

To use a client certificate authentication scheme, you:

1. Create a policy at the producer/Identity Provider to protect the relevant service. This policy will use the client certificate authentication scheme.
2. Enable client certificate authentication at the consumer/Service Provider.

How to Use Client Cert. Authentication with an IIS 5.0 Web Server

Client certificate authentication is not supported for IIS 5.0 Web servers at the producer/Identity Provider. However, it can be used on an IIS 5.0 Web server at the consumer/Service Provider to communicate with a non-SiteMinder producer/Identity Provider.

To work around this issue, use the IIS 5.0 Web server's client certificate functionality at the producer/Identity Provider and do not configure SiteMinder's client certificate functionality. If you apply this workaround, be aware that the CN portion of the certificate's DN value must contain the affiliate name value.