CAC Card Access

[Joe Kaplan \(MVP - ADSI\)]

This should be easy to do in ASP.NET. I'm not sure about WinForms.

Essentially, in ASP.NET you just need to make sure that you're site requires
SSL and you require client certificates. When the user navigates to the
website, then will be prompted for the certificate to send and should get
prompted for the smart card PIN as well.

In WinForms, you would have to come up with an authentication mechanism that
required the smart card. This would depend a lot on how you planned to
communicate with the server. If it is via a web services interface with
HTTPS, then you should be able to specify a client certificate in your proxy
class that would result in the same prompt for the smart card PIN. I'm not
sure about that. Also, if you aren't using planning to use SSL, you'll need
a network protocol that supports certificate auth.

Joe K.

"Roy" <Roy@discussions.microsoft.com> wrote in message
news:7E5CA06A-5E0D-4276-94A6-C52329BB20C5@microsoft.com...

> Greetings,
>
> I need to read a certificate stored inside a CAC (SmartCard) from both an

ASP.NET and WinForm application to authenticate users. The CAC card is
attached to the client computer via USB.

>
> Is .NET capable of this? If so, what classes accomplish this and do

examples exist?

>
> Or, do I need a third party SDK?
>
> Thanks,
>
> Roy

[Joe Kaplan \(MVP - ADSI\)]

Yes, setting up IIS for client certificate authentication should work fine.

I'd try getting it working in the browser first and then getting it working
in the WinForms code. There is a ClientCertificates property on the proxy
class that you can set to supply the client certificate to use.

Joe K.

"Roy" <Roy@discussions.microsoft.com> wrote in message
news:506406D0-9DC9-4277-899E-895DD8AA36C8@microsoft.com...

> Thanks Joe.
>
> Both the winform and the webform clients connect to a web service that

retrieves

> data from a data base.
>
> client<->web service<->DB
>
> Also, we are required to use SSL and HTTPS.
>
> Your suggestion seems like it would work for both of them if I can figure

it

> out.
>
> Does this mean I can setup IIS for client authentication for the web

service URL,

> and IIS will do do the authentication for both applications?
>
> Roy
>