How to configure IIS 10 IISCertificateMappingAuthenticationModule for a classic mode application.

Hi @Cross, Don (Omaha) ,

Thank you for the detailed trace and screenshots, they made this much easier to narrow down.

The Access Security page does list SslMapCert as a valid value for sslFlags, but the IIS Manager SSL page doesn't offer an equivalent setting

I see what you mean about the documentation. The Attributes table on the Access Security <access> page does list SslMapCert, but the Overview section on that same page only lists None, Ssl, SslNegotiateCert, SslRequireCert, and Ssl128. Those five are also the only values accepted by IIS 10, which matches the error in both of your screenshots. Certificate mapping is turned on through the authentication section instead, so SslMapCert isn't needed in sslFlags.

Failed request tracing suggests the module is not being invoked

Looking at the trace more closely, IISCertificateMappingAuthenticationModule does seem to run, since AuthTypeSupported="MapCliCert" appears. It then ends without authenticating, which suggests the request isn't carrying a client certificate for the module to map. IIS asks the client for a certificate when sslFlags includes SslNegotiateCert, so with Anonymous disabled, the request ends with 401.2.

The module not appearing on the Authentication page is expected, since IIS Manager doesn't provide a UI for it. Configuration Editor or appcmd can be used instead, as covered in IIS Client Certificate Mapping Authentication.

I would recommend trying these steps:

1. Remove SslMapCert from sslFlags in applicationHost.config.
2. In IIS Manager, open SSL Settings for the site or application, check Require SSL, and set Client certificates to Require (or Accept if some callers may not send a certificate yet). Require sets sslFlags to Ssl, SslNegotiateCert, SslRequireCert.
3. Keep Anonymous authentication disabled and certificate mapping enabled. These sections are locked at the server level by default, so they need to be set in applicationHost.config inside a <location> element rather than in web.config. For example, with a one-to-one mapping:

       <location path="YourSite/YourApp">
         <system.webServer>
           <security>
             <access sslFlags="Ssl, SslNegotiateCert, SslRequireCert" />
             <authentication>
               <anonymousAuthentication enabled="false" />
               <iisClientCertificateMappingAuthentication enabled="true" oneToOneCertificateMappingsEnabled="true">
                 <oneToOneMappings>
                   <add enabled="true" userName="DOMAIN\account" password="..." certificate="MIID...(single-line Base64 certificate, without BEGIN/END lines)" />
                 </oneToOneMappings>
               </iisClientCertificateMappingAuthentication>
             </authentication>
           </security>
         </system.webServer>
       </location>
   

4. Recycle the application pool before testing the SOAP call again, as the 500.19 error may persist until the configuration is reloaded.

On the Classic mode concern, a similar setup with an ASMX SOAP service in a Classic app pool authenticated as the mapped account in a lab test, so Classic mode itself doesn't seem to be the blocker. That said, it might be worth trying this in a non-production environment first.

I hope this gets the certificate mapping working for you. If you found my assistance helpful or informative, I would greatly appreciate it if you could follow this guidance or provide your insights.  

The Access Security <access> page does list SslMapCert as a valid value for sslFlags, but the IIS Manager SSL page doesn't offer an equivalent setting and after applying the value directly to the applicationHost.config sslFlags options triggers this alert when trying to open the SSL page in IIS Manager

Attempting to invoke the Soap call returns this error message: