ADFS Client Certificate Authentication

Question

Hi Everyone,

We're working through standing up our first ADFS server in our server farm. We have hit a snag when it comes to the client smartcard authentication. A quick rundown on our setup and what I have tried so far.

We have a single ADFS server with a certificate with certauth as a SAN so client certificates authenticate over 443. Within Authentication methods client certificate is enabled as an authentication method. I have also added the following rules within Claims Provider Trusts I added the following claim rules.

-EKU, UPN, serial Number, Issuer, and X.509

I also checked the NTAuth store and all client certificates intermediate and respective roots are present for all the smart cards used.

Our smart cards work with every other service on our network. Also, username and password through ADFS works as well.

I do get prompted for smart card when I select client certificate login. Once I enter the PIN for my smart card I get redirected to the following errors.

Error 364
Microsoft.IdentityServer.NoValidCertificateException: MSIS7121: The request did not contain a valid client certificate that can be used for authentication. This occurs when there are no valid certificates on the client computer, for example if all certificates have expired or been revoked.
Error Code: 0x800B0109
at Microsoft.IdentityServer.Web.Authentication.TlsClientAuthenticationHandler.ThrowCertificateErrorException(Int32 errorCode)
at Microsoft.IdentityServer.Web.Authentication.TlsClientAuthenticationHandler.ProcessIntranetRequest(ProtocolContext context, WrappedHttpListenerRequest request)
at Microsoft.IdentityServer.Web.Authentication.TlsClientAuthenticationHandler.Process(ProtocolContext context)
at Microsoft.IdentityServer.Web.Authentication.AuthenticationOptionsHandler.Process(ProtocolContext context)
at Microsoft.IdentityServer.Web.PassiveProtocolTlsClientListener.OnGetContext(WrappedHttpListenerContext context)

An error occurred
No valid client certificate found in the request. No valid certificates found in the user's certificate store. Please try again after closing and reopening the browser and choose a different authentication method.

I really appreciate any help you can provide!

Answer 1

Anything? I'm sure I can't be the only one who has experienced this, hopefully someone can help.

Answer 2

Update for everyone who comes across this issue.

I was able to resolve this by making the following registry changes.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel

• Add "ClientAuthTrustMode" with a value of 2
• Either delete or add the value of 0 for "SendTrustedIssuerList"

Answer 3

Thanks alot,
Ive been facing this issue for a while