Internet Information Services
Microsoft web server software.
1,419 questions
Authorisation post client certificate authentication
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 22%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED0%3C/text%3E%3C/svg%3E)
dobxml-0229
31
Reputation points
I have set up a website to use certificate client authentication
I now get a 401.3 when accessing the site i.e. not authorised
How do you go about creating users, associating them to the certificate and authorising users?
{count} votes
-
dobxml-0229 31 Reputation points
2023-08-30T10:34:01.4766667+00:00 Sepcifically IIS Client Certificate Mapping Authentication
-
Lex Li (Microsoft) 3,816 Reputation points2023-08-30T19:21:59.73+00:00 You need to dig further into that 401.3 error first, and learn what exactly caused it, https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/health-diagnostic-performance/troubleshoot-php-with-failed-request-tracing, because authentication already passes successfully when you see an authorization error.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(3.2, 24%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESW%3C/text%3E%3C/svg%3E)
Sam Wu-MSFT 6,431 Reputation points Microsoft Vendor2023-08-31T03:23:31.2166667+00:00 It is difficult to reproduce your problem based on your description, how did you set up certificate client authentication? and please post details about the 401.3 error.
-
dobxml-0229 31 Reputation points
2023-09-01T11:31:08.2966667+00:00 Detailed Error Information:
IISCertificateMappingAuthenticationModule Notification AuthenticateRequest Handler StaticFile Error Code 0x8009310b https://ipaas-spike2.cbfsai.local:443/data.json Physical Path X:\inetpub\xxxx\data.json Logon Method Not yet determined Logon User Not yet determined Request Tracing Directory C:\inetpub\logs\FailedReqLogFiles -
dobxml-0229 31 Reputation points
2023-09-01T11:33:44.07+00:00 Note from above the Logon method is not yet determined. We have disabled anonymous, ASP.NET impersonation, forms and windows auth. How does a certificate get mapped to a user? I though it was in system.webServer/security/authentication/iisClientCertificateMappingAuthentication/oneToOneMappings but now I'm not so sure.
-
dobxml-0229 31 Reputation points
2023-09-01T11:34:43.65+00:00 Apologies it is a 401.1 not 401.3 as previously advised (sorry!)
-
Sam Wu-MSFT 6,431 Reputation points Microsoft Vendor
2023-09-05T07:16:53.2433333+00:00 Try use failed request tracking to view detailed error information.
Sign in to comment