Before Microsoft Internet Security and Acceleration Server (ISA) 2006 Service Pack 1 (SP1), you could only require a client certificate when the Web listener was configured to use forms-based authentication of domain users by using the Active Directory directory service (FBA with AD). This authentication method uses the following process:
- The client provides a client certificate.
- ISA Server verifies that the certificate is valid, that it has not expired, and that it was issued by a trusted certification authority.
- ISA Server checks the certificate against the ISA Server client certificate restrictions.
- ISA Server sends the authentication form to the client. The user enters his or her credentials and posts them.
- ISA Server verifies the user credentials.
- ISA Server maps the client certificate to an Active Directory user and verifies that it is the same user by using the credentials.
In ISA Server 2006 SP1, you can require a client certificate when the Web listener is configured to use forms-based authentication with other authentication validation methods, such as LDAP (Active Directory), RADIUS, RADIUS OTP, or SecurID. When you use authentication methods other than forms-based authentication with Active Directory, ISA Server performs the same process, except that it does not try to map the client certificate to a user. This means that the ISA Server computer does not have to be a member of a domain. Or, if the computer is a domain member, it means that the client certificates do not have to be mapped to user accounts in Active Directory.
This article describes the default behavior in ISA Server 2006 SP1 when you use forms-based authentication of domain users with Active Directory. Additionally, this article describes how to change this default behavior.