June 2010 - SmartcardServices-Users

Next Gen SmartCard Help (Gemalto 144)
by Mills, Kevin S CTR USAF AFMC 46 SK/SKI 24 Jun '10

24 Jun '10

Afternoon all, We recently moved from the older Common Access Cards (CAC) to the Next Gen Gemalto 144k CAC. I am not sure how the network admins had it configured before, but they had used some way of logging into the Mac by mapping the Unix hash to the Active Directory. Like I said they had no idea what they were doing. They followed some post they found on Google. That way has crashed and burned since we moved to the NG CAC. We are no longer able to log in with the CAC and it will not communicate with any of the web servers using SSL and that are CAC enabled. We get the following error: "The website <WEBSITE ADDRESS> did not accept the certificate <CERTIFICATE NAME>" No matter what certificate we select it displays this error with the list of certificates that are on the card. We do have the CAC-NG package installed. We have Leopard 10.5.8 installed and the CAC-NG package associated with that version installed as well. When we open the Keychain Access app the Smart Card will show up as CACNG instead of CAC and it does allow us to unlock the CAC and view the certs that are on the card. The certs even display as being verified. We are wondering if there is an official Mac document on what needs to be done to get this working on Leopard 10.5.8. The network admins are dragging their feet and grumble, grumble, grumble when we tell them to contact someone at apple who does this for a living. All other branches of the Federal Government and Military who are using Macs have them CAC enabled without any problems (they even talk to the Active Directory). Im wondering if they just messed things up when they "locked down" the computers to put them on the network. Any help is greatly appreciated. Thanks, Kevin Mills 46 SK/SKI TYBRIN Corp.

2 1

Safari 5 broke my CAC card
by Michael Kluskens 24 Jun '10

24 Jun '10

Begin forwarded message: > Mac OS X 10.6.4 made NO changes to Smart Card Services. Check for > other issues on your system. With further testing I isolated the problem to the installation of Safari 5 on 10.6.3 or Safari 5 with 10.6.4, which introduced the pop- up dialog box for CAC certificate choosing, with Safari 5 I get one identity certificate followed by two or four email certificates, none of which works. I'm not the only one whose CAC card was broken by Safari 5, a co-worker in the Center of Computational Science also lost use of his CAC card when Safari 5 was installed on 10.6.3. 1) Clean install of OS X 10.6.3 (build 10D575), no data migration, no extra languages, fonts, or printers 2) launch Safari 4.0.4 & connect to infosec.navy.mil, success 3) Software update including Safari 5 but excluding OS X 10.6.4 4) launch Safari 5, connect to infosec.navy.mil, FAILURE 5) launch Safari 4.0.4 from base OS X 10.6.3, connects successfully 1) Clean install of OS X 10.6.3 (build 10D575), no data migration, no extra languages, fonts, or printers 2) launch Safari 4.0.4 & connect to infosec.navy.mil, success 3) Software Update install Safari 5 only 4) launch Safari 5, connect to infosec.navy.mil, FAILURE 5) launch Safari 4.0.4 from base OS X 10.6.3, connects successfully 6) Configure Mail with IMAP, check new message for encryption and signing - success 1) Clean install of OS X 10.6.3 (build 10D575), no data migration, no extra languages, fonts, or printers 2) Connect to infosec.navy.mil, success 3) Software Update install OS X 10.6.4 only (includes Safari 5) 4) launch Safari 5, connect to infosec.navy.mil, FAILURE 5) launch Safari 4.0.4 from base OS X 10.6.3, connects successfully 6) Configure Mail with IMAP, check new message for encryption and signing - success I also tested my CAC card with my reader (SCRx31 FW 5.2.5) on my home iMac with 10.6.4 and Safari 5, failed there as well. For whatever reason, Safari 5 does not work with a Oberthbur ID One V5.2 Dual CAC card with a SCRx31 FW 5.25 reader. We confirmed that a co-worker's Oberthur CAC does not work with my reader on my machine, but his Oberthur CAC does work with his Omnicard reader on his machine. Michael Kluskens

2 2

sc_auth "CSSMERR_DL_MISSING_VALUE" error
by fakesexnoises 14 Jun '10

14 Jun '10

Hi, Running OS X 10.6.3, with OpenSC 0.12.0 from here: http://www.opensc-project.org/opensc/wiki/MacInstaller Using a PKCS11 Engine supplied by one of the OpenSC devs. Smart Card: Feitian PKI mini-SIM from gooze.eu Smart Card Reader: SCM SCR3320 Following the instructions here: http://www.gooze.eu/howto/smartcard-quickstarter-guide I've transferred a 2048-bit RSA private key and associate certificate to my new Smart Card. I've modifed the /etc/authorization file. Now I'm trying to run the sc_auth script to associate a user account to my Smart Card, and receiving the following error: security: SecKeychainSearchCopyNext: CSSMERR_DL_MISSING_VALUE I found the following thread at the Apple mailing lists: http://lists.apple.com/archives/fed-talk/2010/Feb/msg00058.html He's having an identical issue, ie. "the card shows up in the Keychain, but none of the certificates show up and the Keychain for it can't even be unlocked." He was advised to install CAC-NG Tokend (BETA v0.95) for Mac OS X 10.6. Does this advice apply in my case also? Thanks, S.

2 2

ECA Hardware Token - Certs not showing up in Keychain
by Bob Colbert 04 Jun '10

04 Jun '10

I just received an ECA Hardware Assurance certificate. It is a ActivIdentity USB Token as shown here - http://www.actividentity.com/products/authenticationdevices/USBTokens/ . I have the one without the one-time password display. Of course set up of the device and placing the certificates on it was done with ActivClient on Windows at the ECA facility. Got back to the office and installed the ActivClient in my Fusion virtual machine with XP. Verified the certs were there and have set it up such that Outlook can use them. Everything looks fine thus far. Details of the USB Token in the Windows ActivClient is the following: Manufacturer: Oberthur Model: CosmopolIC 64K V5.2 When I plug the device into the Mac (running Snow Leopard 10.6.3), the device shows up in the Keychain as a CAC-xxx entry. I double-click the lock and it prompts me for the PIN. I think it is unlocking because a windows pops up titled “Common Access Card” with two tabs for Identification and Benefits, none of which are populated because this isnt a CAC card. However, no certificates are displayed. I am selecting the “All Items” category in Keychain (and My Certificates/Certifcates category too) and still nothing is showing up. I think I am close, but maybe this device isnt fully supported? ---- Bob Colbert DE Technologies

2 2