We use the certpub.nsf database to collect third party x509 web id certificates. We have several sites that use SSL and the x509 certificate that was collected to authenticate/authorize a user (no username/pwd). The SSL setting on the “Security” tab on the Internet Site Documents all have the following settings:
TCP Authentication:
Anonymous = No
Name & Pwd = No
Redirect to SSL = Yes
SSL Authentication:
Anonymous = No
Name & Pwd = No
Client certificate = Yes
This has be working great (or so we thought) and our customers love the ability to log in using their certificate.
We started noticing that there were “Anonymous” users in the database users list. I checked the http logs and sure enough, Anonymous users were accessing the site. What we found was that users are attempting to access the site and are picking their EMAIL certificate instead of their WEB ID certficate from the browser certificate store. If that happens, the user is hit with the “Sign In” screen but if they hit REFRESH on the browser the webpage is rendered to them. Anyone else have this problem? I would have thought that since Anonymous is disallowed that they would not be able to access the page. Seems to me like something is going wrong? Anyone else have this problem or notice this issue?
Any help would be greatly appreciated!
Wendall