Client side authentication, 2 sided SSL

Question

Hi,
Is using client side SSL auth. effective when working (via webservice) with a load balancer (SSL termination) that passes requests to a server connected to it?
Is this ok? considered a best practice? does the client side certificate add any security?
THANKS!

Answer 1

I agree with you sabre150. However, I was restricting my comments to the authentication part of Access Control (which I once defined in a book as being a three-part protocol dance, where every part is related, but independent):
i) Identification - where someone claims to be somebody who needs access to a resource;
2) Authentication - where that someone has to prove they are who they claim to be; and
3) Authorization - where the system determines if that authenticated entity is authorized to access the resource.
Sending the Client SSL certificate is Identification (anyone can do this so it doesn't prove anything). Digitally signing the nonce sent by the server is the proof (and the Authentication part of the dance). Verifying authorization is completely separate from the authentication part of the decision (which is what you referred to).
Many people confuse all three steps as "authentication" because it happens seamlessly on most systems; but in reality, they are distinct parts that can be interchanged - you can use a username-string as an identifier, a password as an authenticator and a UNIX group membership for authorization. You can also use an LDAP DN as an identifier, a digital signature as an authenticator and a XACML rule-set for authorization - and so on.
In the end, a system must do all three parts of the dance to provide access to protected resources; SSL ClientAuth focuses on only the authentication part of the dance; and for SSL ClientAuth to be considered secure, the protection of the Private Key becomes the single most important determinant. Everything after the verification of the digital signature is an authorization decision (which you pointed out).
(Sorry for the long answer, but I often make mistaken assumptions that cause me to write more cryptically than I should).
Arshad Noor
StrongAuth, Inc.