February 2011 - SmartcardServices-Users

Question from a New Person Testing Smart Cards
by Will Coleman 25 Feb '11

25 Feb '11

Hi All, Thanks for putting this board together, it's extremely helpful. I have a question with an implementation I'm struggling with. I've setup a single server with both a CA / AD and DC configured. I am testing smartcards from JITC (Government Issues SmartCards) for a company that provides software for corporations that would like to use Active Directory for identity management on Macintosh. The crux of our solution allows users to be provisioned in Active Directory and then have the ability to login using those credentials into their Macs. My test environment is setup properly and I am able to successfully login via a windows machine using the Gov't issued smartcard into my local Active Directory instance (separately, I'm able to login using my Mac with an Active Directory supplied username and password). However, there is a small problem, the govt issued smartcards themselves seem to have "two identities", one is a "NT Principle Name ID" (I believe) and the other is a PIV credential (with several additional numbers following the NT Principle Name. The default sign-on credential is the PIV and in windows you can switch to another identity and successfully login to the Windows machine. If you want to get an idea of what I'm talking about – take a look at these set of pictures I've posted on photobucket (I've scrubbed them of specific ID's) Here is the album with the three photos that are annotated – I think this will make much more sense for everyone. Hopefully everyone understands photobucket. http://s1097.photobucket.com/albums/g355/wqcoleman/Smart%20Card%20Login%20O… Macintosh unfortunately picks the default credential, in this case, PIV, which means I am unable to login using the smartcard – since I can't provision the ID in AD to work – I get a "credentials cannot be verified when I try to login using the PIN". I have the advantage of selected the proper credentials in Windows 7, but again, Mac does not allow this and I'm sure there is some configuration in either Mac, Active Directory or somewhere that will either 1) force the credentials that is working for login (see picture with the NT Principle Name) or 2) allow me to provision the PIV credential into AD and allow for the user to login? Please accept my apologies for not using the proper nomenclature, I'm learning this as fast as I can and it's been a crash course in smartcards, certs, etc.. Thanks in advance for any help, -- William Q. Coleman Centrify Corporation

2 13

Re: [SmartcardServices-Users] of Oberthur 128 cards
by John Daly 24 Feb '11

24 Feb '11

Greetings all, I note that there have been no changes in the software for almost a year. Is there any idea of when we might get the capability to use the Oberthur 128 v5.5 CAC cards? I have a growing number of people who have them and are getting very frustrated with the "you can't get there from a Mac" answer. Thank you, John

4 7

CAC Login and pkinit
by David Bruno (Civ ARL/CISD) <dbruno> 23 Feb '11

23 Feb '11

Hello, I have two questions. 1. Based on reading posts from this list and in other places, we have pieced together a cac login solution using the pubkeyhash method. We do not currently have a directory service implemented. However, I¹m curious if there is a way to utilize attribute matching with the local directory service on a MAC OS 10.6.6 client? The pubkeyhash cac login option is working great, however we would like to implement a solution where the AuthenticationAuthority field does not need to be updated every time a user is given a new smartcard. 2. I read a few posts about pkinit being available in 10.6.2 and later, and specifically a security vulnerability with pkinit which was fixed in 10.6.6. I just want to verify that the security vulnerability has been patched. Also I have not been able to successfully implement the method described in this post: http://lists.macosforge.org/pipermail/smartcardservices-users/2010-July/0001 17.html by Shawn Geddis - I¹ve been using the command: /System/Library/PrivateFrameworks/Heimdal.frameworks/Helpers/kinit C KEYCHAIN: -D: KEYCHAIN: --pk-enterprise for testing as described in the post above, however when I use -pk-enterprise option it connects to our KDC requesting a ticket for the PersonIdentifier\@mil instead of asking for my username like username@realm. When I use the -enterprise option instead of pk-enterprise it correctly asks our KDC for a ticket for username@realm. However I keep getting PREAUTH_FAILED errors. Also if we do get the test command working with the enterprise instead of pk-enterprise, is that still a valid test for getting a kerberos ticket at login with a smartcard? As a side note just running kinit works fine with no issues. Our linux machines have pkinit working with a subject mapping to the common name on the card to their linux username. Is there a way to do a subject mapping like this in OS 10.6.6? Please excuse any terms I messed up I¹m another person who has been getting a crash course in smart cards. Any help would be greatly appreciated. Thank you _______________________ David Bruno Security +, RHCT, CCNA, CCA ARL/CISD 410-278-8929 david.bruno(a)us.army.mil

1 0

Did CAC-NG make the trunk for SL or not?
by Miller, Timothy J. 17 Feb '11

17 Feb '11

I thought it had, but I noticed today that a coworker's Gemalto 144K card doesn't work right (shows in Keychains, but no certs). Comment? -- T

3 4

PCSC still not working with 64bit Java on OS X 10.6.6
by Clemens Orthacker 15 Feb '11

15 Feb '11

Hello all, We are still experiencing a problem we already reported in 2009: http://lists.macosforge.org/pipermail/smartcardservices-users/2009-Septembe… It seems there also is an open ticket for this issue: http://smartcardservices.macosforge.org/trac/ticket/47 As described in our previous post, Java (via smartcardIO/JNI, 64bit) finds the terminal but no card. Below is the output from pcscd. It seems to be blocked in winscard.c:199:SCardEstablishContext() Establishing Context: 17019343 [0x0103B1CF] Is this a known issue? Will there be a resolution? Please let me know if any further logging is required. Any help is appreciated. Thanks, Clemens $ sudo /usr/sbin/pcscd -fd /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/debuglog.c:240:DebugLogSetLevel() debug level=debug /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:585:main() pcsc-lite 1.4.0 daemon ready. /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:1545:ReaderCheckArchitecture() Send respawn signal to pcscd (pid=4441) /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:678:signal_respawn() Got signal to respawn in 32 bit mode /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:294:SVCServiceRunLoop() Preparing to exit... /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:1048:RFCleanupReaders() entering cleaning function /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/debuglog.c:240:DebugLogSetLevel() debug level=debug /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:585:main() pcsc-lite 1.4.0 daemon ready. /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:781:RFInitializeReader() Attempting startup of Gemplus GemPC Twin 00 00 using /usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:507:RFBindFunctions() Binding driver functions /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:643:RFBindFunctions() Loading IFD Handler 3.0 /SourceCache/SmartcardCCID/SmartcardCCID-35253/ccid/ccid/src/ifdhandler.c:1323:init_driver() Driver version: 1.3.8 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg_srv.c:217:SHMProcessEventsServer() Common channel packet arrival /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg_srv.c:226:SHMProcessEventsServer() SHMProcessCommonChannelRequest detects: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:256:SVCServiceRunLoop() A new context thread creation is requested: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_svc.c:178:ContextThread() Thread is started: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:119:SHMClientReadMessage() SHMClientReadMessage: Issuing read for 48 bytes (header) /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:500:SHMMessageReceive() SHMMessageReceive errno: 0x00000000: no error /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:501:SHMMessageReceive() SHMMessageReceive retval: 0x00000000, bytes read: 48 <== SHMMessageReceive: 12 34 56 78 00 00 00 3C 00 00 00 F8 00 00 01 F6 00 00 00 14 00 00 00 F8 4D 5A 8C 7B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:122:SHMClientReadMessage() SHMClientReadMessage: read message header error: 0x00000000 [0x00000000] /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:148:SHMClientReadMessage() SHMClientReadMessage: Issuing read for 12 bytes /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:500:SHMMessageReceive() SHMMessageReceive errno: 0x00000000: no error /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:501:SHMMessageReceive() SHMMessageReceive retval: 0x00000000, bytes read: 12 <== SHMMessageReceive: 00 00 00 03 00 00 00 00 5F C0 AE 41 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:153:SHMClientReadMessage() SHMClientReadMessage: read message body error: 0x00000000 [0x00000000] /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg_srv.c:293:SHMProcessEventsContext() correctly processed client: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_svc.c:242:ContextThread() Client is protocol version 3:0 ==> SHMMessageSend: 12 34 56 78 00 00 00 3C 00 00 00 F8 00 00 01 F6 00 00 00 14 00 00 00 F8 4D 5A 8C 7B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:119:SHMClientReadMessage() SHMClientReadMessage: Issuing read for 48 bytes (header) /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:500:SHMMessageReceive() SHMMessageReceive errno: 0x00000000: no error /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:501:SHMMessageReceive() SHMMessageReceive retval: 0x00000000, bytes read: 48 <== SHMMessageReceive: 12 34 56 78 00 00 00 3C 00 00 00 F1 00 00 01 F6 00 00 00 14 00 00 00 01 4D 5A 8C 7B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:122:SHMClientReadMessage() SHMClientReadMessage: read message header error: 0x00000000 [0x00000000] /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:148:SHMClientReadMessage() SHMClientReadMessage: Issuing read for 12 bytes /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:500:SHMMessageReceive() SHMMessageReceive errno: 0x00000000: no error /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:501:SHMMessageReceive() SHMMessageReceive retval: 0x00000000, bytes read: 12 <== SHMMessageReceive: 00 00 00 00 00 00 00 00 00 00 00 00 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:153:SHMClientReadMessage() SHMClientReadMessage: read message body error: 0x00000000 [0x00000000] /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg_srv.c:293:SHMProcessEventsContext() correctly processed client: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard.c:199:SCardEstablishContext() Establishing Context: 17019343 [0x0103B1CF] ==> SHMMessageSend: 12 34 56 78 00 00 00 3C 00 00 00 F1 00 00 01 F6 00 00 00 14 00 00 00 01 4D 5A 8C 7B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 03 B1 CF 00 00 00 00

1 0