Policy Server Guides › Policy Server Configuration Guide › Authentication Schemes › X.509 Client Certificate or HTML Forms Authentication Schemes

X.509 Client Certificate or HTML Forms Authentication Schemes

The X.509 Client Certificate or HTML Forms authentication scheme allows either HTML Forms authentication or X.509 Client Certificate authentication to establish a user's identity. In order for a user to authenticate successfully, one of the following two events must occur:

• The user's X.509 client certificate must be verified.

  OR

• The user must provide the credentials requested by an HTML form.

With this scheme, when a user requests a protected resource, the Web Agent challenges the user's browser to present a certificate, after which the scheme has the following effect:

This scheme is useful if you need to gradually deploy X.509 certificates. For example, in a company with 50,000 users, it is a challenge to issue and deploy 50,000 certificates simultaneously. This scheme allows you to issue certificates as you see fit (500 or 5,000 at a time). During this transition period, your resources can be protected with certificates for those who already have them, allowing other authorized users to access resources based on HTML forms credentials.

Note: If you implement multiple certificate-based authentication schemes that include a mixture of X509 Certificate OR Forms schemes, a browser caching limitation may cause unexpected behavior. When a user chooses not to use the certificate-based authentication for accessing a resource in a realm protected by a Certificate or Forms authentication scheme, the browser (both IE and Netscape) automatically caches this decision not to send the certificate. If the same user (using the same browser session) then attempts to access a resource that is protected by an authentication scheme with a mandatory certificate portion, such as X509 Certificate, X509 Certificate and Basic, or X509 Certificate and Form, the user will receive a " Forbidden " error message.

Since the user chose not to send a certificate for the certificate-based authentication when accessing the first resource, and the browser cached that decision, the user is automatically rejected when accessing the realm that requires the certificate.

Users who have valid certificates should be encouraged to use them when accessing resources in a deployment that includes a mixture of realms protected by certificate-based authentication schemes that include X509 Certificate or Forms schemes and other certificate-based schemes that do not allow a user to choose whether or not to send a certificate for authentication.