07-23-2020 05:30 PM
This is by design. If you allow a user to connect using Credential OR Client Cert, we'd need a username from the client cert.
A workaround is to set the User Name in the Certificate Profile to using the Subject Alt Name of the Certificate. When you generate the Machine Certificate for the Pre-Logon, do NOT put anything in the Subject Alt Name field. This should allow both Machine Cert users (without Cookies) and non-Machine Cert users.
Best practice would be to set-up 2 Portals and 2 Gateways. One with the CertProfile (for your domain trusted machines) and one without (for your contractors).
