How To: Route Traffic to the Appropriate Certificate Enrollment Realms

Version Affected: All

 

Overview

This article explains how to automatically route users to the correct certificate enrollment realm based on their browser, using Microsoft's IIS URL Rewrite tool. SecureAuth IdP has two Post Authentication methods for certificate enrollment: Create PFX lets a user download a certificate and import it into their browser's certificate store, while Native Mode Cert Landing Page downloads and imports the certificate automatically with no user action required, but only works in Internet Explorer. Because of this, many customers configure one realm of each type and use a URL Rewrite rule to route each user to the correct one for their browser. There are two rules below — use the one, or both, that fit your setup:

• Method 1: routes Internet Explorer users away from a Create PFX realm to a Native Mode Cert Landing Page realm.
• Method 2: routes Chrome/Firefox users away from a Native Mode Cert Landing Page realm to a Create PFX realm.

In this article

• Method 1: Redirect Internet Explorer Users to a Native Mode Cert Landing Page Realm
• Method 2: Redirect Chrome/Firefox Users to a Create PFX Realm

Method 1: Redirect Internet Explorer Users to a Native Mode Cert Landing Page Realm

First, create (or configure existing) realms to serve as certificate enrollment realms — one using Create PFX, one using Native Mode Cert Landing Page. The examples below use SecureAuth21 as the Create PFX realm and SecureAuth20 as the Native Mode Cert Landing Page realm — substitute your own realm names and URLs throughout.

1. Install Microsoft's URL Rewrite IIS tool if you haven't already.
2. Open Internet Information Services (IIS) Manager, expand the directory under your machine's name, expand Sites and Default Web Site, and click your Create PFX realm (for example, SecureAuth21). Double-click URL Rewrite.

3. From the Actions panel, click Add Rule(s)..., select Blank rule under Inbound rules, and click OK. Name the rule, under Using select Wildcards, and under Pattern enter *. From the Action type drop-down, select Redirect and enter the Native Mode Cert Landing Page realm's URL (for example, https://YourWebsiteName/secureauth20).
4. Expand Conditions and click Add. Set Condition input to {HTTP_USER_AGENT}, Check if input string to Matches the Pattern, and Pattern to *MSIE*, then click OK. This condition redirects traffic to the Native Mode Cert Landing Page realm whenever the visiting browser is Internet Explorer.

The screenshot below shows this condition's Edit Condition dialog, with Condition input {HTTP_USER_AGENT}, Matches the Pattern, and Pattern set to *MSIE*.

5. From the Actions panel, click Apply to save the rule.

The screenshot below shows the completed Edit Inbound Rule screen for this rule, with the Match Any condition group showing the MSIE pattern, the Action type set to Redirect to the Native Mode Cert Landing Page realm, and Apply highlighted in the Actions panel.

Method 2: Redirect Chrome/Firefox Users to a Create PFX Realm

This method mirrors Method 1, applied to the Native Mode Cert Landing Page realm instead.

1. Open IIS Manager, expand Sites and Default Web Site, and click your Native Mode Cert Landing Page realm (for example, SecureAuth20). Double-click URL Rewrite.

2. From the Actions panel, click Add Rule(s)..., select Blank rule under Inbound rules, and click OK. Name the rule, under Using select Wildcards, and under Pattern enter *. From the Action type drop-down, select Redirect and enter the Create PFX realm's URL (for example, https://YourWebsiteName/secureauth21).
3. Expand Conditions, from the Logical grouping drop-down select Match Any, and click Add. Set Condition input to {HTTP_USER_AGENT}, Check if input string to Matches the Pattern, and Pattern to *Firefox*, then click OK. Repeat this step to add a second condition with Pattern set to *Chrome*.

The screenshots below show these two conditions' Edit Condition dialogs, with Pattern set to *Firefox* and *Chrome* respectively.

4. From the Actions panel, click Apply to save the rule.

The screenshot below shows the completed Edit Inbound Rule screen for this rule, with the Match Any condition group showing both the Firefox and Chrome patterns, the Action type set to Redirect to the Create PFX realm, and Apply highlighted in the Actions panel.

Test both rules externally from another machine by browsing to each realm's URL with each browser.
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.