Guidance on X.509 login handler or ECP profile for .NET app

[Cantor, Scott]

> I see I have the following options (but would like guidance on the preferred
> way to handle this use case):

Neither necessarily makes sense unless the application is acting as a user, and in such a case, it would be bad (often impossible) to rely on a password mechanism, and may or may not make sense to allow impersonation via a certificate issued to a service. It certainly isn't a standard use case.

Normally these flows are just not done with end to end user security, they're done with impersonation of users by a service account. Doing better than that is complex. When it's one hop deep and a browser is the initiator, OAuth is also reasonably well-designed for that use case.

> Lastly, no changes are needed on SP to support the X.509 login handler; is
> this correct?

Which SP are you talking about?

-- Scott