Username and password seems to have no effect

[woodsidenetworksadmin]

When authenticating to the server, once you have enrolled a device and have a client cert, if the user account's password is changed, it does not stop further sessions. If the account is disabled, you can no longer log in, same if its deleted. But ... if you re-enable the account, or even recreate the account, that user can authenticate again with the old client certificate.

This seems to originate from the following code in EudHandler.py
if self.is_ssl and not self.is_authenticated and (auth or self.common_name):

This isint a good security practice and should be changed so that authentication requires a valid username/password regardless of certificate

[brian7704]

This behavior is the same as the official takserver and is intended. It is secure because both the client and server are validating each other's certificates on each connection. Either disable/delete the user or use openssl to revoke the user's certificate.