Mapping Client Certificates with Directory Service Mapping
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1
Important
If you use directory service mapping, you cannot use one-to-one or many-to-one mapping for the entire World Wide Web Publishing Service (WWW service).
Directory service (DS) certificate mapping uses native Windows Active Directory features to authenticate users with client certificates. For information about mapping a certificate to an Active Directory user account, see "Map a certificate to a user account" in Help and Support Center for Windows Server 2003.
Important
You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /user:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".
Procedures
To enable Directory Service mapping
In IIS Manager, right-click the Web Sites node, and then click Properties.
On the Directory Security tab, select the Enable the Windows directory service mapper check box, and then click OK.
Related Information
For information about how to map a specific client certificate to a user account, see Mapping Client Certificates One-to-One.
For information about how to map many user accounts to a single client certificate, see Mapping Client Certificates Many-to-One.
For information about when to use each type of client certificate mapping, see Mapping Strategies.
For general information about certificates, see SSL and Certificates.