- SmartcardServices-Users - lists.macosforge.org

Setup guide.
by Sami M'Barek 07 Oct '13

07 Oct '13

Hi, I'm trying to get this working with our internal CA. We've been printing cards for a while and it's been working just fine with PCs. I've been trying to test it out with Mac OS X 10.8.5 to be more exact. I've tried following an older guide made by Apple, stating to edit /etc/authentication without success. (http://support.apple.com/kb/TA24244) The card reader works without issues. I'm able to sign and encrypt mails with other certs on the card. Basically I'm wondering if someone can point me in the right direction regarding login in to my OS X system using Smart Cards from internal CAs. Best regards /Sami

2 1

Smart Card Services Update v2.0.b2-MtLion -> downloaded package treated as damaged
by Steve Ramsay 04 Oct '13

04 Oct '13

Shawn, I am seeing the same problem when I attempt to open this package (Mtn. Lion ver. 10.8.5). I have followed the instructions on the page regarding installing the root CA certificates in the keychain and still cannot open the package. I see that this thread appears to have been opened in May of this year and I was wondering what the resolution is to this issue and when it will be made available to the community. Steve ______________________________________________________________________ This email has been scanned by the Boundary Defense for Email Security System. For more information please visit http://www.apptix.com/email-security/antispam-virus ______________________________________________________________________

1 0

I would like to post a reply to a discussion thread
by Steve Ramsay 04 Oct '13

04 Oct '13

Dear admin, I would like to post a message to the thread: [SmartcardServices-Users] Smart Card Services Update v2.0.b2-MtLion -> downloaded package treated as damaged <https://lists.macosforge.org/pipermail/smartcardservices-users/2013-May/000…> . I am seeing the same problem when I attempt to open this package (Mtn. Lion ver. 10.8.5). I have followed the instructions on the page regarding installing the root CA certificates in the keychain and still cannot open the package. I see that this thread appears to have been opened in May of this year and I was wondering what the resolution is to this issue and when it will be made available to the community. Sincerely, Steve Ramsay, IT manager DEXA SYSTEMS The Trusted Choice in Cyber-Security 5851 San Felipe, Suite 400 Houston, TX 77057 +1 281-846-2601 steve.ramsayi(a)dexasystems.com<mailto:steve.ramsayi@dexasystems.com> * www.dexasystems.com<http://www.dexasystems.com/> [Description: twitter-logo]<http://twitter.com/#!/DexaSystems> ______________________________________________________________________ This email has been scanned by the Boundary Defense for Email Security System. For more information please visit http://www.apptix.com/email-security/antispam-virus ______________________________________________________________________

1 0

More PKI, and cacloginconfig
by John Daly 30 Sep '13

30 Sep '13

Greetings again everyone. So, I've now got cacloginconfig.plist to map my CAC "Common Name" to dsattrtype:native:uid on the user account. With that, when a CAC is inserted into the client machine bound to my Open Directory system, it will ask for a PIN for the correct user. The problem is that it will not take the PIN. If I switch back to using pubkeyhash, then the PIN works, but kerberos doesn't, so the home folder doesn't mount. Any ideas? Thank you John

1 0

Of OpenDirectory, PKI-INIT and CAC
by John Daly 23 Sep '13

23 Sep '13

Greetings, So I've made a lot of progress, thanks to a combination of Apple Support and Yoann Gini, but still have a little bit to go. Apparently, in order to get kerberos to work on CAC login, one has to have PKI-INIT engaged. I'm running a MacOS X Server OpenDirectory system. Has anyone ever gotten the cacloginconfig.plist to work with OpenDirectory? If so, could you share how? Has anyone even found directions to using cacloginconfig.plist? If so, can you point me there? Thank you, John

1 0

Re: [SmartcardServices-Users] CAC login
by John Daly 10 Sep '13

10 Sep '13

I know this is absolutely no help to Barry whatsoever, but I absolutely second his question. I'm trying to set up CAC login for Open Directory. I run both the server and the clients, but I can't find any set of instructions beyond Yoann Gini's set, which are very nice, but I haven't been able to get them to work. I can get local account logins to work great with pubkey hash. For one afternoon, I could get my test clients to authenticate to the open directory, but I couldn't log in because the home folder wouldn't mount, and then with no configuration changes, it simply quit working, and I can't get any more test machines to work again. Instruction FAQs would be great! Troubleshooting FAQ would be wonderful as well. Thank you, John > Message: 2 > Date: Wed, 02 Jan 2013 11:58:40 -0700 > From: "Barry McInnes (NOAA Affiliate)" <barry.j.mcinnes(a)noaa.gov> > To: smartcardservices-users(a)lists.macosforge.org > Subject: [SmartcardServices-Users] CAC Login ? > Message-ID: <50E48360.8090805(a)noaa.gov> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > I had a quick look through the archives, but could not find anything > related. > I have installed Smart Card Services Update 2.0b2-ML-signed package, and > the SmartCard > is visible when inserted (attached). I selected the optional install of > cacloginconfig, but cannot find the CACLoginConfig.plist file. > I am trying to authenticate via Active Directory. > Is there a FAQ anywhere on how to set this up ? > thanks barry

2 1

(no subject)
by Daniel Elmore 02 Sep '13

02 Sep '13

I'm am currently trying to download the middleware for OX 10.8 to use my cac card reader on Safari. I was given this sight through a DOD website. All I can find in the upgrade for the middleware and not the middleware it's self. I would like to know where I can get said middleware. Thanks, Daniel Elmore

3 2

More open directory smart card login fun
by John Daly 30 Aug '13

30 Aug '13

Greetings all, I'm attempting to get smart card logins to work on my 10.6, 10.7, and 10.8 clients attached to a 10.6.8 Server with Open Directory. All users have a network account, and we've been directed to engage smart card logins and deny username/password logins. I can get the local login to work using a combination of smartcardservices from MacOSforge and Thursby's Pkard, but I have not been able to get it to work with a directory account. Yoann Gini has a great set of instructions and a modified sc_auth which I tried. The sc_auth does put the smart card's hash into the Open Directory account's Authentication Authority, but I still can't get the login window to ask for a PIN if the account is on the directory. Any ideas? Clues? Step by step instructions? Thank you, John

3 2

Certificate Authentication Issue
by Peter Walsh 13 Aug '13

13 Aug '13

Apologies in advance for a) long post &/or b) if this is the wrong list for this. We have enabled PKI authentication on a system we developed and our Safari users (especially CAC) are experiencing odd behavior. We are not sure if it is a server, client or card side issue. A) If we set SSLClientVerify to optional in http.conf (creates problems for Safari) In this mode, browsers should prompt a user to present a certificate, if one exists in the browser's realm of places to look for certificates. On the Mac, Safari and Chrome use the Keychain. If the user a) doesn't have a certificate, or b) cancels the browser's request to choose a certificate, and no certificate is provided, the server will continue to serve resources as it normally would. Browsers will generally not ask the user about a cert again for the entire browser session. However, in all browsers other than Safari on the Mac, whenever the server-side SSL session expires, the browser re-presents the certificate that the user provided to the server initially. On Mac Safari, the client will prompt the user to select a certificate each time the SSL session expires even though it should theoretically pass through the already-presented cert. This behavior is seen only under 2 conditions: 1) SSLClientVerify is optional, and, 2) Safari knows about multiple client certificates (for example a CAC, which always contains an identity and email cert). In addittion, even if there is Mac Keychain "Identity Preference," Safari seems to ignore any identity preference that is set, or any knowledge of a cert it already sent in this situation. If the CAC isn't present, Safari will pass the com.apple.idms.appleid.prd.[UUID} cert which will fail as an invalid user id. As a note: Mozilla appears to have struggled with this issue (which seems to have been a conscious design decision) for a long time: https://bugzilla.mozilla.org/show_bug.cgi?id=149673 B) SSLClientVerify require (creates problems for IE 8/9) In this mode, browsers will prompt a user to present a certificate. If there is no cert available to the browser, or the user cancels the request for a certificate, the server will return a 403 (Forbidden) error. Typically, this is configured not for an entire "VirtualHost", but rather only for a given "Location" stanza in Apache's config. However, whenever Apache encounters a change in the SSLClientVerify (i.e., it goes from "none" to "require"), it attempts to do an SSL renegotiation, since it has previously negotiated the SSL connection with one set of parameters and now needs to re-negotiate with a different set of parameters. When we attempt to use this functionality on our "Location" (a URL we access with POST requests) that deals with certificate processing, all browsers prompt for client certificate immediately. Most browsers successfully do the re-negotation (albeit with varying levels of server-side attempts before finally succeeding) within a second. IE 8 and IE 9, however, attempt to do the re-negotation and is never successful, eventually timing out when it reaches the global timeout value set in Apache. If the user immediately re-attempts the connection, it goes thru. In this configuration, Safari users behave like others. Thanks. Peter Walsh Jackpine Technologies, Inc. peter.walsh(a)jackpinetech.com c. 617/816-6001

1 0

Installer for mountian lion 10.8
by Roberto B. Amador 13 Aug '13

13 Aug '13

Sir, the following install package is failing during install. I am getting a certificate expired message at the beginning of the install which leading me to think is failing the entire process. Is there an updated installer with updated certificate available? Even though it says new, it was updated 18 september 2012. Almost a year ago. I hate having to take both my PC and MAC anywhere I go just to keep up with work. Thank you, Roberto **NEW** Smart Card Services Update v2.0.b2-MtLion (Sep 18, 2012) OS Requirement: OS X Mountain Lion v10.8 SHA-1 Hash: 4b012dd7a8f39f68311a6f48aa734c9231ac1e3f This installs the Tokend modules which no longer ship from Apple as part of Mac OS X beginning with OS X Lion (v10.7). Note that this installer will ONLY install onto OS X Mountain Lion v10.8. The Tokend modules installed are: BELPIC, CAC, CACNG, JPKI and PIV. New to this release: • JPKI.Tokend - Build 38522 added to the update to support LASCOM in Japan. • cacloginconfig.plist - Default configuration file as optional install for those using Attribute Matching or PKINIT configurations. • SystemCACertificates.keychain - Automatically added to the Keychain Search List if not already present. The Installer has been digitally signed, but it is possible you may not have the Intermediate CA Certificate on your system for signature validation. If you do not have it, you can pull it down from Apple's Root Certification Authority site with the specific Intermediate CA Certificate found HERE.

1 0