- SmartcardServices-Users - lists.macosforge.org

MAC
by Jay Watkins 06 Dec '13

06 Dec '13

How to install certificate for use with the MAC OS X. I need clear instructions to use CAC Reader to access work email. Jay

1 0

PKINIT failed on OS X 10.9 but not on Windows 7
by Yoann Gini 26 Nov '13

26 Nov '13

Hi folks, First of all, if I didn’t publish anything at this time on Windows integration it’s because I’ve been busy, and also because I’ve a troubleshooting sessions on a client network this week, so I think it will be valuable for the article :-) At least if I find the bug. Does anyone have already seen a PKINIT system working well on Windows 7 but not on OS X 10.9 ? We have a Charismathics middleware (same on OS X and Windows) and a Nexus PKI linked to a 2k8 AD. Everything work well on Windows (authentication and PKINIT, confirmed via a network capture) but on OS X, the certificate is validated by the trust chain but it’s unusable to handle PKINIT part. If my AD account is configured as a portable account with local data pre existing (so no need to connect to a share point at the login time), authentication work well. The card is also OK when we have to sign somethings. But, if my user account is not yet on the system / network only, the authentication fail. Running kinit command line with needed options for PKINIT lead me to the common error: kinit: krb5_pk_enterprise_certs: Failed to find PKINIT certificate: Certificate not found I’ve pass the whole day digging with debugger and disassembler to understand where is the problem and I’ve ended with a problem in the certificate matching system, Heimdal seems to not understand the LocalKeyID (OID 1.2.840.113549.1.9.21). I’m not sure if I’m on the right track or not… Does anyone have some experience to share here? Best regards, Yoann.

1 0

use multiple tokend
by Rogers, Ed 25 Nov '13

25 Nov '13

Problem solved. Thank you to Michael J. Danberry who pointed me to militarycac.com. It has a nice matrix of smart card enablers vs. OS, CAC type, and PIV & Firefox compatability. The combination of OS X 10.9 and an Oberthur ID One 128 v5.5 CAC limited the options (no SmartCard Service support). I downloaded CACkey (CAC.tokend) but was unsuccessful. While it recognized the CAC, the corporate PIV smart card was still shown as an “Unknown Token”. I uninstalled CACkey and loaded Centrify Express. This time both CAC (CACNG.tokend) and corporate smart card (PIV.tokend) were recognized. R/ Ed Rogers SWFTS SE&I Technical Director LM Manassas (703) 367-1620

1 0

Re: [SmartcardServices-Users] Process behind /etc/cacloginconfig.plist for Windows authentication ?
by Yoann Gini 18 Nov '13

18 Nov '13

Hi all, First of all, I’m sorry for the noise, after re reading my whole config and my command line history I’ve see my error. On my SmartCard I’ve made a mistake when loading the certificate. I’ve used the wrong PIN ID to protect the private key. So, my authentication is now working. However, like Henry pointing out, the may have some difference between opening a session and getting a TGT… And actually (on a 10.9), the Kerberos didn’t get the TGT from the login. Klist ask me for a password. Does someone did successfully enable PKINIT/Kerberos things ? Thanks for your interest, of course, if I end up with a working config, I will write a blog article :-) Yoann

3 2

[OT] MS CA and OpenSC
by Yoann Gini 18 Nov '13

18 Nov '13

Hi folks, Before being able to make PKINIT work with OS X and Active Directory, I need to be able to create a certificate with the good capabilities. MS CA have a specific template made for smart card authentication that need to be used to create a certificate who support PKINIT. The problem I have is, this certificate when created is marked as un-exportable, so I can’t just create a p12 on a Windows and load it on my smart card from an OS X computer. I have to make my OpenSC SmartCard fully functional on Windows system to be able to create and load directly my certificate from a Windows system who can run the MMC Certificate administrative tool. And here is the problem, I’ve installed the OpenSC driver on my Windows but the system don’t recognize it correctly. I’m clearly off topic here but since the final goal is the SmartCard on OS X, I hope you won’t blame me… So, if someone here have experience with OpenSC and Windows, I would like an quick help :-) Best regards, Yoann.

2 1

Re: [SmartcardServices-Users] Process behind /etc/cacloginconfig.plist
by Daly, John CIV NAVAIR, 4L6200D 15 Nov '13

15 Nov '13

HI Yoann. Thanks to your blogs, I've been able to get smart card authentication working with Open Directory, but never using cacloginconfig.plist. I can marry an attribute in the user account to an attribute in the card in cacloginconfig.plist, but it still fails to log in on OpenDirectory. kerberos has likewise never worked, either with the pubkeyhash configuration or the cacloginconfig.plist. rumor has it that if the PKI-INIT worked, then kerberos would also work with cacloginconfig.plist, but it sounds like that might not be the case, since supposedly Active Directory is PKI-INIT capable, where apple's OpenDirectory is not. If you get it working, I'd love to see the blog on it. thanks John Message: 2 Date: Thu, 14 Nov 2013 22:51:55 +0100 From: Yoann Gini <yoann.gini(a)gmail.com> To: SmartCard Services-Users <smartcardservices-users(a)lists.macosforge.org> Subject: Re: [SmartcardServices-Users] Process behind /etc/cacloginconfig.plist for Windows authentication ? Message-ID: <C56B42ED-6E51-45F1-B83D-855328A9555F(a)gmail.com> Content-Type: text/plain; charset="windows-1252" Hi all, First of all, I?m sorry for the noise, after re reading my whole config and my command line history I?ve see my error. On my SmartCard I?ve made a mistake when loading the certificate. I?ve used the wrong PIN ID to protect the private key. So, my authentication is now working. However, like Henry pointing out, the may have some difference between opening a session and getting a TGT? And actually (on a 10.9), the Kerberos didn?t get the TGT from the login. Klist ask me for a password. Does someone did successfully enable PKINIT/Kerberos things ? Thanks for your interest, of course, if I end up with a working config, I will write a blog article :-) Yoann

1 0

Process behind /etc/cacloginconfig.plist for Windows authentication ?
by Yoann Gini 14 Nov '13

14 Nov '13

Hi folks, I’m trying to make SmartCard authentication works against Windows AD without the need of a middleware. In theory, it should be possible, we only need to configure /etc/cacloginconfig.plist to match the user from the SmartCard. I’ve set this config file really simply: <key>fields</key> <array> <string>NT Principal Name</string> </array> <key>formatString</key> <string>$1</string> <key>dsAttributeString</key> <string>dsAttrTypeNative:userPrincipalName</string> And when I insert the card on the login window, I got the good user. However, and I don’t know why, the authentication isn’t accepted. The PIN field shake just like if my PIN code was wrong (it’s not the case). I’ve setup a TCP wiretap between the client and the Windows Server and when I hit enter, I see a network traffic asking LDAP and MS GC requests (with the good UPN inside). My thought is the requirements to validate authentication aren’t here. But I don’t know the requirements. Does someone know how /etc/cacloginconfig.plist based authentication is supposed to work? What’s are the authentication steps and what should be set on the AD to handle cert based authentication. Best regards, Yoann.

2 1

Updated blog article: OS X Mavericks and SmartCard Support
by Yoann Gini 06 Nov '13

06 Nov '13

Hi folks, I know my previous article on OS X Lion have been useful for some people here, so let me inform the list that I’ve updated my article for OS X Mavericks. http://blog.inig-services.com/archives/1448 (as always, non-french speaker can use google translate if needed) Thanks for the off list reply on my previous e-mail, they’ve allow me to add informations for support of non-opensc compatible systems. For people who have already read the old one, the only difference with 10.9 is at the end. Since /etc/authorization have been replaced by a SQLite database (/var/db/auth.db) we can’t edit the file directly. Hopefully, Apple have updated the command line tool related to authorization database to offer a single line command to enable SmartCard support: sudo security authorizationdb smartcard enable However, this command enable smartcard support but don’t disable password capabilities. I will use one of my DTS ticket to ask how we are supposed to disable password support from login window and screen saver. Best regards, Yoann

1 0

Support for 10.9?
by Yoann Gini 06 Nov '13

06 Nov '13

Hi folks, I’ve start looking for smartcard support on 10.9, I don’t see any specific update on MacOSForge regarding this topic. Do you know if we’ve a hope here? Best regards Yoann

1 0

Sending S/MIME Smartcard-Signed E-Mail on Mavericks
by Chris Leduc 19 Oct '13

19 Oct '13

Hello List! I use a SuisseID Smartcard to send signed E-Mail through Outlook. Outlook recognizes that the smart card is inserted into the Mac and lets me sign it properly. However, Mail.app does not show me the usual sign/encrypt buttons. The feature is still there, since it works when a certificate/key pair is installed directly in the keychain (from symantec in that instance). Any experience with that? Cheers Chris

2 1