November 2013 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

use multiple tokend
by Rogers, Ed 17 Jan '14

17 Jan '14

I need to use both a CAC and a company issued smart card (PIV). I’m using OS 10.9 and find that if I have both the CAC.tokend and the PIV.tokend installed, that only the first card used is supported and the next is not recognized. I end up having to remove one of the tokend for the other to work. Is there a tokend that supports both CAC and PIV or some way to allow both to be used such that the correct tokend is selected based on the card inserted? R/ Ed Rogers SWFTS SE&I Technical Director LM Manassas (703) 367-1620

3 4

PKINIT failed on OS X 10.9 but not on Windows 7
by Yoann Gini 26 Nov '13

26 Nov '13

Hi folks, First of all, if I didn’t publish anything at this time on Windows integration it’s because I’ve been busy, and also because I’ve a troubleshooting sessions on a client network this week, so I think it will be valuable for the article :-) At least if I find the bug. Does anyone have already seen a PKINIT system working well on Windows 7 but not on OS X 10.9 ? We have a Charismathics middleware (same on OS X and Windows) and a Nexus PKI linked to a 2k8 AD. Everything work well on Windows (authentication and PKINIT, confirmed via a network capture) but on OS X, the certificate is validated by the trust chain but it’s unusable to handle PKINIT part. If my AD account is configured as a portable account with local data pre existing (so no need to connect to a share point at the login time), authentication work well. The card is also OK when we have to sign somethings. But, if my user account is not yet on the system / network only, the authentication fail. Running kinit command line with needed options for PKINIT lead me to the common error: kinit: krb5_pk_enterprise_certs: Failed to find PKINIT certificate: Certificate not found I’ve pass the whole day digging with debugger and disassembler to understand where is the problem and I’ve ended with a problem in the certificate matching system, Heimdal seems to not understand the LocalKeyID (OID 1.2.840.113549.1.9.21). I’m not sure if I’m on the right track or not… Does anyone have some experience to share here? Best regards, Yoann.

1 0

use multiple tokend
by Rogers, Ed 25 Nov '13

25 Nov '13

Problem solved. Thank you to Michael J. Danberry who pointed me to militarycac.com. It has a nice matrix of smart card enablers vs. OS, CAC type, and PIV & Firefox compatability. The combination of OS X 10.9 and an Oberthur ID One 128 v5.5 CAC limited the options (no SmartCard Service support). I downloaded CACkey (CAC.tokend) but was unsuccessful. While it recognized the CAC, the corporate PIV smart card was still shown as an “Unknown Token”. I uninstalled CACkey and loaded Centrify Express. This time both CAC (CACNG.tokend) and corporate smart card (PIV.tokend) were recognized. R/ Ed Rogers SWFTS SE&I Technical Director LM Manassas (703) 367-1620

1 0

Re: [SmartcardServices-Users] Process behind /etc/cacloginconfig.plist for Windows authentication ?
by Yoann Gini 18 Nov '13

18 Nov '13

Hi all, First of all, I’m sorry for the noise, after re reading my whole config and my command line history I’ve see my error. On my SmartCard I’ve made a mistake when loading the certificate. I’ve used the wrong PIN ID to protect the private key. So, my authentication is now working. However, like Henry pointing out, the may have some difference between opening a session and getting a TGT… And actually (on a 10.9), the Kerberos didn’t get the TGT from the login. Klist ask me for a password. Does someone did successfully enable PKINIT/Kerberos things ? Thanks for your interest, of course, if I end up with a working config, I will write a blog article :-) Yoann

3 2

[OT] MS CA and OpenSC
by Yoann Gini 18 Nov '13

18 Nov '13

Hi folks, Before being able to make PKINIT work with OS X and Active Directory, I need to be able to create a certificate with the good capabilities. MS CA have a specific template made for smart card authentication that need to be used to create a certificate who support PKINIT. The problem I have is, this certificate when created is marked as un-exportable, so I can’t just create a p12 on a Windows and load it on my smart card from an OS X computer. I have to make my OpenSC SmartCard fully functional on Windows system to be able to create and load directly my certificate from a Windows system who can run the MMC Certificate administrative tool. And here is the problem, I’ve installed the OpenSC driver on my Windows but the system don’t recognize it correctly. I’m clearly off topic here but since the final goal is the SmartCard on OS X, I hope you won’t blame me… So, if someone here have experience with OpenSC and Windows, I would like an quick help :-) Best regards, Yoann.

2 1

Re: [SmartcardServices-Users] Process behind /etc/cacloginconfig.plist
by Daly, John CIV NAVAIR, 4L6200D 15 Nov '13

15 Nov '13

HI Yoann. Thanks to your blogs, I've been able to get smart card authentication working with Open Directory, but never using cacloginconfig.plist. I can marry an attribute in the user account to an attribute in the card in cacloginconfig.plist, but it still fails to log in on OpenDirectory. kerberos has likewise never worked, either with the pubkeyhash configuration or the cacloginconfig.plist. rumor has it that if the PKI-INIT worked, then kerberos would also work with cacloginconfig.plist, but it sounds like that might not be the case, since supposedly Active Directory is PKI-INIT capable, where apple's OpenDirectory is not. If you get it working, I'd love to see the blog on it. thanks John Message: 2 Date: Thu, 14 Nov 2013 22:51:55 +0100 From: Yoann Gini <yoann.gini(a)gmail.com> To: SmartCard Services-Users <smartcardservices-users(a)lists.macosforge.org> Subject: Re: [SmartcardServices-Users] Process behind /etc/cacloginconfig.plist for Windows authentication ? Message-ID: <C56B42ED-6E51-45F1-B83D-855328A9555F(a)gmail.com> Content-Type: text/plain; charset="windows-1252" Hi all, First of all, I?m sorry for the noise, after re reading my whole config and my command line history I?ve see my error. On my SmartCard I?ve made a mistake when loading the certificate. I?ve used the wrong PIN ID to protect the private key. So, my authentication is now working. However, like Henry pointing out, the may have some difference between opening a session and getting a TGT? And actually (on a 10.9), the Kerberos didn?t get the TGT from the login. Klist ask me for a password. Does someone did successfully enable PKINIT/Kerberos things ? Thanks for your interest, of course, if I end up with a working config, I will write a blog article :-) Yoann

1 0

Process behind /etc/cacloginconfig.plist for Windows authentication ?
by Yoann Gini 14 Nov '13

14 Nov '13

Hi folks, I’m trying to make SmartCard authentication works against Windows AD without the need of a middleware. In theory, it should be possible, we only need to configure /etc/cacloginconfig.plist to match the user from the SmartCard. I’ve set this config file really simply: <key>fields</key> <array> <string>NT Principal Name</string> </array> <key>formatString</key> <string>$1</string> <key>dsAttributeString</key> <string>dsAttrTypeNative:userPrincipalName</string> And when I insert the card on the login window, I got the good user. However, and I don’t know why, the authentication isn’t accepted. The PIN field shake just like if my PIN code was wrong (it’s not the case). I’ve setup a TCP wiretap between the client and the Windows Server and when I hit enter, I see a network traffic asking LDAP and MS GC requests (with the good UPN inside). My thought is the requirements to validate authentication aren’t here. But I don’t know the requirements. Does someone know how /etc/cacloginconfig.plist based authentication is supposed to work? What’s are the authentication steps and what should be set on the AD to handle cert based authentication. Best regards, Yoann.

2 1

Updated blog article: OS X Mavericks and SmartCard Support
by Yoann Gini 06 Nov '13

06 Nov '13

Hi folks, I know my previous article on OS X Lion have been useful for some people here, so let me inform the list that I’ve updated my article for OS X Mavericks. http://blog.inig-services.com/archives/1448 (as always, non-french speaker can use google translate if needed) Thanks for the off list reply on my previous e-mail, they’ve allow me to add informations for support of non-opensc compatible systems. For people who have already read the old one, the only difference with 10.9 is at the end. Since /etc/authorization have been replaced by a SQLite database (/var/db/auth.db) we can’t edit the file directly. Hopefully, Apple have updated the command line tool related to authorization database to offer a single line command to enable SmartCard support: sudo security authorizationdb smartcard enable However, this command enable smartcard support but don’t disable password capabilities. I will use one of my DTS ticket to ask how we are supposed to disable password support from login window and screen saver. Best regards, Yoann

1 0

Support for 10.9?
by Yoann Gini 06 Nov '13

06 Nov '13

Hi folks, I’ve start looking for smartcard support on 10.9, I don’t see any specific update on MacOSForge regarding this topic. Do you know if we’ve a hope here? Best regards Yoann

1 0