Authenticate Anyconnect users using both machine + user cert?

[snyggsomfan]

Hi Everybody,

Is it possible to authenticate Anyconnect users using both machine cert AND personal user cert (smart card) at the same time? Not machine cert OR personal cert. Thanks in advance!

/K

[Marcin Latosiewicz]

Patrik,

I do not belive this to be the case. SSL only asks once for client to present authentication certificate during a session.

Marcin

[snyggsomfan]

OK, that's what I suspected. Would be nice if it was possible though...

/K

[Marcin Latosiewicz]

Patrik,

I guess it might be just a question of multiplexing sessions.

But for us to be on the same page, this is not really the most secure scenario (as well as certificate only authentication).

Typically we say that a proper authentication is based on something you have (certificate,smart card, token etc) and something you know (username/passord). Although the two mix (two factor authentication for exampel), it's still bast to have this separation.

Marcin

[Christopher Bell]

We do something similar - machine cert for the Anyconnect/SBL connection, then the user must authenticate to the laptop using cached domain credentials.  Something they have (the machine cert) and something they know (username/password).  These are separate authentications however.  One is the VPN, the other is technically to the domain.

[snyggsomfan]

I'm with you guys on the security issue - that you shouldn't use only certificate based authentication. But in this case - in order for the user to access his/hers user cert on the smart card a PIN-code must be entered. So authentication would be performed on something the user has (machine cert) and on something the user know (PIN-code to access the user cert on the smart card).

Is authentication still not possible using machine + user cert at the same time?

/K