- SmartcardServices-Users - lists.macosforge.org

[SOLVED] Re: SuisseID on 10.8
by Stephan Rickauer 12 Aug '13

12 Aug '13

Michael, I did add the entire certificate chain but not to the keychain called System. Now I did as you advised and indeed, it works! Thanks a lot, Stephan Michael Kluskens schrieb: > Stephan, > > I don't see where you added certificates to the System Keychain, that was the problem I had. It's barely documented anywhere, but there are references to needing the entire certificate chain in the System Keychain. So if the login certificate is signed by A, then A needs to be in the System Keychain, etc. > > Michael Kluskens

1 0

Mountain Lion Login window
by Jorgensen, Will A 25 Jul '13

25 Jul '13

I'm trying to get a PIV card working for login on mountain lion. I installed the tokend and driver for the reader. When I'm already logged in, the PIV card shows up in the keychain and the certificates show up as valid (I had to install some root certificates to get that). I've used sc_auth to enable the certificate for a local account. I've tried enabling and disabling the cacloginconfig.plist (my understanding is it should be disabled when logging in to a local account). However, under no circumstances have I been able to get a prompt to appear at the login window. I've tried switching back and forth between username/password and list of users views to no affect as well. I'm new to the list and I did some searching in the archives, but I was having trouble dealing with .gz files so I didn’t find much. If this is a question that has already been answered I apologize. Thanks for your help. __________________________________________________ Will Jorgensen Desktop and Mobile Services Pacific Northwest National Laboratory

5 7

SuisseID on 10.8
by Stephan Rickauer 15 Jul '13

15 Jul '13

Hello list, I am trying to get local logon to work on 10.8 using the SuisseID smartcard [1] (not using anything fancy like a Domain, LDAP or whatnot, just plain local fun). What I've done so far: - created a dedicated user called 'sc' - installed Smart Card Services (needed?) - listed available hashes with sc_auth: $ sc_auth hash | grep SwissSign 607BD6C553D5BB8D654AB94AFFBB7C5521D8FBD1 SwissSign_dataEnc AA779E7AD6DBB45AFCA48C64F1118E115DFB5604 SwissSign_nonRep B6EFD1C9C5DA0D4B70E18B580BD22757D53D79AA SwissSign_digSig 607BD6C553D5BB8D654AB94AFFBB7C5521D8FBD1 SwissSign_dataEnc - and assigned the right one to user 'sc': $ sc_auth list -u sc B6EFD1C9C5DA0D4B70E18B580BD22757D53D79AA - properly edited /etc/authorization according to [2] When the logon screen appears and the SuisseID USB stick is plugged in, the screen switches to PIN entry mode. However, the PIN entered would not work (even though it is correct, keyboard mappings can be ruled out, too). The system.log states: Jul 15 14:06:09 macmini.local com.apple.SecurityServer[15]: Token reader ACS ACR 38U-CCID 00 00 inserted into system Jul 15 14:06:14 macmini.local com.apple.SecurityServer[15]: token inserted into reader ACS ACR 38U-CCID 00 00 Jul 15 14:06:16 macmini.local com.apple.SecurityServer[15]: reader ACS ACR 38U-CCID 00 00 inserted token "SwissSignID" (SwissSignID-7bff2081ef0c1920) subservice 2 using driver com.cryptovision.scinterface.tokend Jul 15 14:06:16 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:16 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:16 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:16 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:24 macmini.local SecurityAgent[113]: User info context values set for sc Jul 15 14:06:24 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:24 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:24 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:24 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:31 macmini.local SecurityAgent[113]: User info context values set for sc Jul 15 14:06:31 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:31 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:31 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:31 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:33 macmini.local SecurityAgent[113]: User info context values set for sc Jul 15 14:06:33 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:33 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:33 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:33 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:35 macmini.local com.apple.SecurityServer[15]: Token reader ACS ACR 38U-CCID 00 00 removed from system [...] [3] claims that status code 4 is a good sign, but that doesn't get me any further either. Could anyone point me into the right direction, please? Thanks a lot! Stephan [1] http://postsuisseid.ch/de/documents/doc_download/43-suisseid-specification [2] http://blog.inig-services.com/archives/1068 [3] https://discussions.apple.com/thread/3757421

1 0

Download Failure
by Scott Irwin 05 Jul '13

05 Jul '13

I am trying to download Smart Card Services Update v2.0.b2-MtLion on my MacBook Pro running 10.8.4. I've tried both Safari and Firefox. After agreeing to the to all conditions for the installation, the summary screen returns "The Installation Failed. The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance." Any suggestions? Thanks -P

1 0

CAC Card Issue
by c 05 Jul '13

05 Jul '13

I have a macbook pro with OS X 10.8.4 installed. I downloaded the installer from the website and had no problems. However I was issued a new CAC card - Oberthur ID one 128 v5.5. I cannot access any of the prior sites I used to be able to access. When I go to keychain access I can see the card, It says CAC followed by a bunch of numbers. When I click to unlock it asks for my keychain password but will not open. The card works fine on my Windows computer but I can't use on my mac. Any suggestions? Thank you, CK

2 1

Problem installing Smart card services update 2.0b2
by Walton, Ben 01 Jul '13

01 Jul '13

Hi, I recently renewed my corporate identity certificate and trying to port it to my MAC machine. I can't directly export from my windows machine so attempting to use my activekey instead. I was following instructions that said I needed to install Smart Card Services for the CAC module but the install keeps failing. I'm running 10.8.4 and I think I did something similar in the past as my current certificate is working in Firefox. Maybe that's causing the issue? Does anyone have any ideas? [cid:EC3A5547-09C2-4528-8166-0EFD71D113B7] [cid:CC7078CA-27DC-462E-BE83-C958A5B1EE93]

2 2

Smart Card Services Update v2.0.b2-MtLion -> downloaded package treated as damaged
by Disiena, Ridley (GRC-VG00)[DB Consulting Group, Inc.] 27 May '13

27 May '13

Greetings, I was wondering if there is a current Gatekeeper bug that I am not fully aware of. I am trying to download -> (1) **NEW** Smart Card Services Update v2.0.b2-MtLion (Sep 18, 2012) Even with the signing certificate present on the system, unless the settings for Gatekeeper in Security and Privacy are set to "Anywhere", the package will not run. It always gets: "“Smart Card Services Update 2.0b2-ML-signed” is damaged and can’t be opened. You should move it to the Trash." The reason I believe this to be a Gatekeeper issue is because this only happens if the package was obtained recently from the internet via OS X. I have a local copy which I had backed up from some time before this started occurring, I assume an OS X update. The backed up version has the same SHA-256 hash as the downloaded package. I can install that package on any setting in Gatekeeper even "Mac App Store" which is odd. Any comments or suggestions on this issue? Is there a bug report already open? -Ridley

2 4

How to access an ST-1044U?
by Douglas Wayne 25 May '13

25 May '13

I bought a CHERRY SmartTerminal ST-1044. I installed both the API from the "software" directory on the CD that came with it, along with the driver off their website. The driver was labeled "MacOS CCID, PC/SC driver V3.1.0.2 - Release: 02/14/2012 - 175 kB - MacOS X 10.5.x, 10.6.x and 10.7.x on Intel". FWIW, I'm on MacOS X 10.8. The device shows up in "about this mac" as "SmartTerminal XX44". When I insert a card, the green light briefly blinks red and goes back to green. In system console, I see "5/19/13 10:37:38.487 AM com.apple.SecurityServer[19]: token in reader Cherry SmartTerminal XX44 00 00 cannot be used (error 229)" Really, all I want to do is read all the bytes out of a smart card and be able to modify arbitrary bytes. I'd be very happy if the device showed up as a block device in /Volumes or something. I've tried installing some other software, such as from http://smartcardservices.macosforge.org/trac/browser/trunk/Tokend/PKCS11and http://www.gemalto.com/products/dotnet_card/resources/libraries.html So I'm just stabbing in the dark and probably making the situation worse. :) Anyone out there have any recommendations? Thanks, Douglas

2 1

Request for assistance
by Tim and Deana Woliver 25 May '13

25 May '13

I attempted to download the Smart Card Services Update v2.0.b2-MtLion. (http://smartcardservices.macosforge.org/trac/wiki/installers) When I opened the downloaded file, I first received a dialogue window that says the package was signed with a certificate that has expired. If I acquired this package recently, it may not be authentic. Did I want to continue with the installation anyway? I selected "Continue". I then clicked "Continue" on the "Smart Card Services Update 2.0" and everything initially looks like the the utility will load just fine after clicking the next series of "Continue" buttons. The last "Continue" is one the "Custom Install" window. The only option unchecked is "cacloginconfig" I left it unchecked the first attempt, although I selected it on a subsequent attempt to no avail. After clicking "Install" the process resolves to "There were errors with the installation. You may want to try installing again." "The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance." I'm probably missing something simple and easy. Request any suggestion for fixes or work-arounds so I can use my CAC/reader on my Mac. Vr, Tim

2 1

"Unidentified Developer" error when opening installer?
by Jim Thomas 10 May '13

10 May '13

Shawn, I noticed this with our own installers, and in troubleshooting, found it with yours, too. With Gatekeeper set to default, double-clicking the signed installer pkg results in the following error: ---------------------------------------- "Smart Card Services Update 2.0b2-ML-signed" can't be installed because it is from an unidentified developer. Your security preferences allow installation of only apps from the Mac App Store and identified developers. ---------------------------------------- Any insight would be appreciated. Regards, Jim Thomas, CSCIP/G

2 5