Shibboleth SP and x.509 Authentication

[Oran Wallace]

Hi all,

I've recently been tasked with enhancing an existing ASP.NET application 
with SSO. I've chosen Shibboleth as the SP since other applications 
(though Linux based) in the same network environment employ SSO with 
Shibboleth as an SP and Local IdP. The authentication method is x.509 
certificate.

I currently have Shib setup as an SP for my application and have used 
TestShib to authenticate successfully. Now I have two questions:

After authentication at the IdP, how can I tell which x.509 certificate 
the user used to authenticate? The reason for this is I'd like to query 
the certificated used for the users ID (or something that unique) for 
authorization within the application. Does this have to be an attribute?

Also how can I test with an IdP that performs x.509 authentication? Do I 
have to stand up an IdP and config x.509 auth?

Any help on this matter is greatly appreciated.

~Oran