HOW TO: Configure IIS to Leverage Smart Card Authentication (4339206)

The Active Roles Web Interface will not prompt with a credential tile in Internet Explorer unless IIS is configured properly.

NOTE: In order to force Internet Explorer to prompt with a new credential tile, use File | New Session

1. Open Server Manager. Click Start | Administrative Tools | Server Manager
2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes .
3. Expand Roles , and then click Web Server (IIS) .
4. In the results pane under Role Services , click Add Role Services .
5. Select the Client Certificate Mapping Authentication check box, and then click Next .
6. Click Install .
7. When the role service is added, click Close .

1. Click Start | Administrative Tools | Internet Information Services (IIS) Manager
2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes .
3. In the console tree, click on the server name.
4. In the results pane of the server Home page, double-click Authentication to open the Authentication page.
5. In the results pane of the Authentication page, right-click Active Directory Client Certificate Authentication , and then click Enable .
6. Close IIS Manager.

1. Click Start  | Administrative Tools | Internet Information Services (IIS) Manager
2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes .
3. In the console tree, expand the server name.
4. Expand Sites , and then expand the Web site that is hosting the Active Roles Web Interface. By default, the Web site name is Default Web Site
5. In the console tree, select the site name (i.e. ARWebAdmin)
6. In the results pane on the Home page, double-click SSL Settings
7. Choose the appropriate Client certificates setting ( Accept or Require ). You should choose Accept  if you want clients to have the option to supply authentication credentials by using either a smart card certificate or a user name and password. You should Requireclient certificates if you want only clients with client-side certificates such as smart cards to be able to connect to the service.
8. Click Apply .
9. Repeat steps 5-8 for any additional Active Roles Web Interface Sites as desired.
10. Close IIS Manager.
11. In an elevated command prompt, run iisreset