- SmartcardServices-Users - lists.macosforge.org

Sharepoint 10 authorization problems?
by David Emery 10 Dec '12

10 Dec '12

Army ASA (ALT) migrated from SharePoint 07 to SharePoint 10 over the weekend, and I'm now getting an authorization error. http://www.olimpia.com/foo.jpg (Not much useful information there!) Sequence of events was to log onto AKO using CAC & PKard 1.1, then click on the new SharePoint link. SharePoint twice asked me if I wanted to use "Windows" or "AKO" credentials; both times I answered "AKO". Has anyone else experienced problems with SharePoint 10? (If you're able to connect through CAC to another DoD SharePoint 10 site, I'd appreciate knowing that...) thanks in advance dave

1 0

Problem recognizing Apple's Root Certification Authority cert
by Kasprzyk, David C 05 Dec '12

05 Dec '12

I had no issue installing the Smart Card Services Update 2.0.b2 for Mountain Lion on one of my 10.8.2 machines (one that already had developer tools installed), however on a clean 10.8.2 machine. I'm unable to install the package, even after manually adding the certificate to my login key chain. I'm getting the same error that Thomas Carroll reported on Nov 8th to the list. What am I missing with my certificate install that the OS still thinks the update is untrusted? Thanks for the help, David

1 0

Re: [SmartcardServices-Users] smart card installation on OS X 10.8.2
by Shawn Geddis 08 Nov '12

08 Nov '12

On Nov 8, 2012, at 5:20 PM, Jorge Bastos Neto <jbastosneto(a)me.com> wrote: > Dear Shawn, > I have on my card my personal digital certificate used to digitally sign contracts and documents > I am new on mac and I am kind lost right now. Can you give me some light? Jorge, OK. You say you installed the SafeSign software token administration. Is the Admin software accessing your token using PKCS#11 or Tokend ? If it is using PKCS#11, that is a completely separate Smart Card abstraction layer that is not provided with OS X and does not integrate into the SmartCard Services (ie. Tokend). If this is the case, then you will never see the Smart Card in Keychain Access which relies on Tokend. If you installed the SafeSign software, aren't they providing support for you and their software ? If you are still a bit lost and are stuck troubleshooting on your own, try the following... Open a Terminal window and execute the following command after the '$' prompt: $ tail -F /var/log/system.log Insert your Smart Card reader and card and watch the lovely information flow by. Wait a second and then hit the <control> key and the <c> key at the same time to kill the tail command. What you will see is logging information relating to processes running which we should see what is going on. Capture the information that flowed by and save as a file. Submit all of the information and your log contents as a ticket at the SmartCardService Project and I'll take a look at it. New Ticket: https://smartcardservices.macosforge.org/trac/newticket - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ > On Nov 8, 2012, at 6:00 PM, Shawn Geddis <geddis(a)me.com> wrote: > >> On Nov 7, 2012, at 9:10 AM, Jorge Bastos Neto <jbastosneto(a)me.com> wrote: >>> Hi There, >>> >>> I need some help to make my smartcard work on my os X 10.8.2 >>> >>> My Card Reader is Gemplus GemPC Twin >>> My Smartcard model is "Sagem Orga J-ID 64k" >>> >>> I have installed the safesign software token administration utility where I can see all the information on my smartcard, test the certificate and works 100%. >>> >>> When I open the keychain access I can't see my smartcard on it. and I can't use the smartcard to log in the website >>> >>> What I have to do to make it work? >>> >>> Thank you for your support >> >> Jorge, >> >> What is the profile on this card ? CAC, CANG, PIV, ... ? >> >> If it is CACNG then note that not all CACNG cards are currently supported by our available CACNG.tokend...yet.

1 0

Re: [SmartcardServices-Users] smart card installation on OS X 10.8.2
by Shawn Geddis 08 Nov '12

08 Nov '12

On Nov 7, 2012, at 9:10 AM, Jorge Bastos Neto <jbastosneto(a)me.com> wrote: > Hi There, > > I need some help to make my smartcard work on my os X 10.8.2 > > My Card Reader is Gemplus GemPC Twin > My Smartcard model is "Sagem Orga J-ID 64k" > > I have installed the safesign software token administration utility where I can see all the information on my smartcard, test the certificate and works 100%. > > When I open the keychain access I can't see my smartcard on it. and I can't use the smartcard to log in the website > > What I have to do to make it work? > > Thank you for your support Jorge, What is the profile on this card ? CAC, CANG, PIV, ... ? If it is CACNG then note that not all CACNG cards are currently supported by our available CACNG.tokend...yet. - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________

1 0

Installer problem (Smart Card Services Update 2.0b2-Lion-signed)
by Thomas Carroll 08 Nov '12

08 Nov '12

I am getting an install error when attempting to install SCS. Here's an excerpt of my log: 11/8/12 9:55:43.952 AM Installer: @(#)PROGRAM:Install PROJECT:Install-690 11/8/12 9:55:43.952 AM Installer: @(#)PROGRAM:Installer PROJECT:Installer-537 11/8/12 9:55:43.952 AM Installer: Hardware: MacBookPro2,2 @ 2.16 GHz (x 2), 3072 MB RAM 11/8/12 9:55:43.953 AM Installer: Running OS Build: Mac OS X 10.7.5 (11G63) 11/8/12 9:55:44.066 AM Installer: Smart Card Services Update 2.0b2 Installation Log 11/8/12 9:55:44.066 AM Installer: Opened from: /Users/cgbosntom/Downloads/Smart Card Services Update 2.0b2-Lion-signed.pkg 11/8/12 9:55:47.409 AM Installer: InstallerStatusNotifications plugin loaded 11/8/12 9:55:47.968 AM Installer: ================================================================================ 11/8/12 9:55:47.968 AM Installer: User picked Custom Install 11/8/12 9:55:47.968 AM Installer: Choices selected for installation: 11/8/12 9:55:47.968 AM Installer: Install: "Smart Card Services Update 2.0b2 " 11/8/12 9:55:47.968 AM Installer: Install: "CAC Tokend (40596)" 11/8/12 9:55:47.968 AM Installer: Install: "PIV Tokend (40596)" 11/8/12 9:55:47.968 AM Installer: Install: "CAC-NG Tokend (40596)" 11/8/12 9:55:47.968 AM Installer: Install: "BELPIC Tokend (40596)" 11/8/12 9:55:47.969 AM Installer: Install: "JPKI Tokend (38522)" 11/8/12 9:55:47.969 AM Installer: ================================================================================ 11/8/12 9:55:53.104 AM Installer: ================================================================================ 11/8/12 9:55:53.104 AM Installer: User picked Standard Install 11/8/12 9:55:53.104 AM Installer: Choices selected for installation: 11/8/12 9:55:53.104 AM Installer: Install: "Smart Card Services Update 2.0b2 " 11/8/12 9:55:53.104 AM Installer: Install: "CAC Tokend (40596)" 11/8/12 9:55:53.104 AM Installer: Install: "PIV Tokend (40596)" 11/8/12 9:55:53.105 AM Installer: Install: "CAC-NG Tokend (40596)" 11/8/12 9:55:53.105 AM Installer: Install: "BELPIC Tokend (40596)" 11/8/12 9:55:53.106 AM Installer: Install: "JPKI Tokend (38522)" 11/8/12 9:55:53.106 AM Installer: ================================================================================ 11/8/12 9:55:53.236 AM Installer: Configuring volume "MBP HD" 11/8/12 9:55:53.250 AM Installer: Free space on "MBP HD": 227.4 GB (227401957376 bytes). 11/8/12 9:55:53.250 AM Installer: Create temporary directory "/var/folders/gy/trq2l6ts09vdjv1h6g9y2rbc0000gn/T//Install.3734XP09Fz" 11/8/12 9:55:53.258 AM Installer: IFPKInstallElement (5 packages) 11/8/12 9:55:53.541 AM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.apple-software 11/8/12 9:55:53.582 AM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.app-store-software 11/8/12 9:55:53.623 AM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.app-store-software 11/8/12 9:55:53.626 AM com.apple.SecurityServer: Failed to authorize right 'system.install.app-store-software' by client '/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/installd' [455] for authorization created by '/System/Library/CoreServices/Installer.app' [3734] 11/8/12 9:55:53.631 AM installd: PackageKit: ----- Begin install ----- 11/8/12 9:55:53.835 AM installd: PackageKit: Install Failed: Error Domain=PKInstallErrorDomain Code=102 "The package “Smart Card Services Update 2.0b2-Lion-signed” is untrusted." UserInfo=0x7fd1f2603ca0 {NSLocalizedDescription=The package “Smart Card Services Update 2.0b2-Lion-signed” is untrusted., NSURL=file://localhost/Users/cgbosntom/Downloads/Smart%20Card%20Services%20Update%202.0b2-Lion-signed.pkg#cac.pkg, PKInstallPackageIdentifier=org.macosforge.SmartCardServices.cac.pkg, NSUnderlyingError=0x7fd1f2510030 "The operation couldn’t be completed. CSSMERR_TP_NOT_TRUSTED"} { NSLocalizedDescription = "The package \U201cSmart Card Services Update 2.0b2-Lion-signed\U201d is untrusted."; NSURL = "file://localhost/Users/cgbosntom/Downloads/Smart%20Card%20Services%20Update%202.0b2-Lion-signed.pkg#cac.pkg"; NSUnderlyingError = "Error Domain=NSOSStatusErrorDomain Code=-2147409622 \"The operation couldn\U2019t be completed. CSSMERR_TP_NOT_TRUSTED\" UserInfo=0x7fd1f250ffd0 {SecTrustResult=5, PKTrustLevel=PKTrustLevelNotTrusted, NSLocalizedFailureReason=CSSMERR_TP_NOT_TRUSTED}"; PKInstallPackageIdentifier = "org.macosforge.SmartCardServices.cac.pkg"; } 11/8/12 9:55:54.640 AM Installer: Install failed: The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. 11/8/12 9:55:54.795 AM Installer: IFDInstallController C9C6C260 state = 7 11/8/12 9:55:54.797 AM Installer: Displaying 'Install Failed' UI. 11/8/12 9:55:54.831 AM Installer: 'Install Failed' UI displayed message:'The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance.'. 11/8/12 9:55:54.847 AM Installer: The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. Thanks for any help/insight.

2 2

Re: [SmartcardServices-Users] Anyone else see smartcard use causing eventual authentication failure? Reporting to Thursby
by Paul Nelson 02 Nov '12

02 Nov '12

This is a known bug in Mac OS 10.7 and 10.8. Thursby has reported this to Apple. Paul On Nov 2, 2012, at 9:38 AM, Simon Hartley <simon(a)thursby.com> wrote: > I've shared this report to Thursby support. +1 (817) 478-5070 or support(a)thursby.com > > If it's in our software, we'll work on it. If it's in OS X, we'll make sure it's a RADAR, if we haven't already. > > Regards, > Simon @Thursby > > > On Nov 1, 2012, at 1:40 PM, Matthew Smith <mls14(a)mac.com> wrote: > > I can reproduce this problem every single time I log into something using my smart card, and I use PKard. The only way for me to fix it is to kill the securityd. I do it with Activity Monitor instead of the CLI. It is documented on a message board for Thursby Software as well. I called Apple about it and they didn't offer much help. I think a bug report would be great. > > Matthew > > On Nov 1, 2012, at 2:29 PM, "Hoit, Daniel S." <hoit2(a)llnl.gov> wrote: > >> We've had several users who have noticed that using a smart card on their system eventually causes authentication services to go out to lunch. Thus, when you click the lock icon in any App, you get nothing. No prompt, no unlock, just nothing. >> Rebooting fixes the issue, as does doing a kill -9 of securityd. >> This appears to happen on both 10.7 and 10.8 whether the smart card itself is being used by the Mac, or passed through to a windows VM. >> >> I'd like to file a bug on it, but duplicating the issue has been difficult up till now. I've seen it personally on my own machines, as well as getting reports of it from the field, but it seemed to be intermittent. I've discovered on at least one of my machine though that I can trigger the condition by unlocking the smart card in keychain access. >> >> Is this a known issue? Anyone else seeing this? >> >> >> Thanks, >> --DH >> >> >> _______________________________________________ >> SmartcardServices-Users mailing list >> SmartcardServices-Users(a)lists.macosforge.org >> http://lists.macosforge.org/mailman/listinfo/smartcardservices-users > > _______________________________________________ > SmartcardServices-Users mailing list > SmartcardServices-Users(a)lists.macosforge.org > http://lists.macosforge.org/mailman/listinfo/smartcardservices-users >

1 0

Anyone else see smartcard use causing eventual authentication failure?
by Hoit, Daniel S. 02 Nov '12

02 Nov '12

We've had several users who have noticed that using a smart card on their system eventually causes authentication services to go out to lunch. Thus, when you click the lock icon in any App, you get nothing. No prompt, no unlock, just nothing. Rebooting fixes the issue, as does doing a kill -9 of securityd. This appears to happen on both 10.7 and 10.8 whether the smart card itself is being used by the Mac, or passed through to a windows VM. I'd like to file a bug on it, but duplicating the issue has been difficult up till now. I've seen it personally on my own machines, as well as getting reports of it from the field, but it seemed to be intermittent. I've discovered on at least one of my machine though that I can trigger the condition by unlocking the smart card in keychain access. Is this a known issue? Anyone else seeing this? Thanks, --DH

4 3

Re: [SmartcardServices-Users] Anyone else see smartcard use causing eventual authentication failure?
by Hoit, Daniel S. 01 Nov '12

01 Nov '12

Peter, Do you have them kill securityd, or reboot? Or is there perhaps another workaround? --DH On Nov 1, 2012, at 11:32 AM, Peter Walsh wrote: > Same issue for all of our team. Seems to happen more on laptops when put to sleep and either on wake up or on wake up onto a new network. Some desktop users never see it. > > Very infuriating. > > > Peter Walsh > Jackpine Technologies, Inc. > peter.walsh(a)jackpinetech.com > c. 617/816-6001 > > > > On Nov 1, 2012, at 2:29 PM, "Hoit, Daniel S." <hoit2(a)llnl.gov> wrote: > >> us, when you click the lock icon in any App, you get nothing. No prompt, no unlock, just nothing. >> Rebooting fixes the issue, as does doing a kill -9 of securityd. >> This appears to happen on both 10.7 and 10.8 whether the smart card itself is being used by the Mac, or passed through to a windows VM. >> >> I'd like to file a bug on it, but duplicating the issue has been difficult up till now. I've seen it personally on my own machines, as well as getting reports of it from the field, but it seemed to be intermittent. I've discovered on at least one of my machine though that I can trigger the condition by unlocking the smart card in keychain access. >> >> Is this a known issue? Anyone else seeing this? >> >> >> Thanks, >> --DH >

2 1

SmartCard Services Stopped Working
by Randall P. Mora 19 Oct '12

19 Oct '12

I am unable to use my Government CAC anymore with the Mac. The CAC is recognized in the System.log but is not accessible in Mail.app or any browser. The following is our log… notice that CAC-5FFF-7F00-62FF-00F0-B5D3 is being inserted and added to the keychain. When I remove the card it is removed from the keyhain and when I add it back it is inserted into the keychaing. But when I try and use the CAC with Mail or browsing a CAC required site the CAC doesn't work or initialize in the application. See below, it look like it is trying but getting the deny file-read-data. Help please, I've been trying to get this working since I upgraded to 10.8. I've installed the most recent update (i.e., Smart Card Services Update 2.0b2-ML-signed.pkg). Oct 17 09:14:35 graphite.local com.apple.SecurityServer[15]: Token reader OmniKey CardMan 3121 00 00 removed from system Oct 17 09:14:35 graphite.local com.apple.SecurityServer[15]: reader OmniKey CardMan 3121 00 00 removed token "CAC-5FFF-7F00-62FF-00F0-B5D3" (CAC-5FFF-7F00-62FF-00F0-B5D3) subservice 31 Oct 17 09:14:41 graphite.local com.apple.SecurityServer[15]: Token reader OmniKey CardMan 3121 00 00 inserted into system Oct 17 09:14:45 graphite.local com.apple.SecurityServer[15]: token inserted into reader OmniKey CardMan 3121 00 00 Oct 17 09:14:45 graphite.local com.apple.SecurityServer[15]: reader OmniKey CardMan 3121 00 00 inserted token "CAC-5FFF-7F00-69FF-00F0-0592" (CAC-5FFF-7F00-69FF-00F0-0592) subservice 32 using driver com.apple.tokend.cac Oct 17 09:15:23 graphite.local com.apple.SecurityServer[15]: Session 100022 created Oct 17 09:15:23 graphite.local com.apple.security.XPCKeychainSandboxCheck[708]: Can't get dir or base (likely out of memory) for CAC-5FFF-7F00-69FF-00F0-0592 Oct 17 09:16:53 graphite.local sandboxd[725] ([259]): WebProcess(259) deny file-read-data /Library/Preferences/com.apple.security-common.plist graphite:log rmora$ security list-keychains "CAC-5FFF-7F00-69FF-00F0-0592" "/Users/rmora/Library/Keychains/login.keychain" "/Users/rmora/Library/Keychains/Microsoft_Intermediate_Certificates" "/Users/rmora/Library/Application Support/Adobe/AIR/ELS/com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1/PrivateEncryptedDatak" "/System/Library/Keychains/SystemCACertificates.keychain" graphite:log rmora$ when trying to bring up mail: Oct 17 09:33:38 graphite.local Mail[864]: Using V2 Layout Oct 17 09:33:38 graphite.local com.apple.SecurityServer[15]: Session 100027 created Oct 17 09:33:38 graphite.local com.apple.security.XPCKeychainSandboxCheck[866]: Can't get dir or base (likely out of memory) for CAC-5FFF-7F00-69FF-00F0-A581 Oct 17 09:33:44 graphite.local Mail[864]: *** -[IADomainCache init]: IA domains cache is out of date. Oct 17 09:33:44 graphite.local SyncServer[868]: [0x7ff56940be40] |DataManager|Warning| Client com.apple.Mail sync alert tool path /System/Library/Frameworks/Message.framework/Resources/MailSync does not exist. THUS the Mail.app will not initialize the ability to digitally sign my emails then when bring up Safari… Oct 17 09:34:47 graphite.local sandboxd[878] ([877]): WebProcess(877) deny file-read-data /Library/Preferences/com.apple.security-common.plist Oct 17 09:34:47 graphite kernel[0]: Sandbox: sandboxd(878) deny mach-lookup com.apple.coresymbolicationd And can't access the customers CAC enabled site. Software OS X 10.8.2 (12C60) Hardware Overview: Model Name: MacBook Pro Model Identifier: MacBookPro10,1 Processor Name: Intel Core i7 Processor Speed: 2.6 GHz Number of Processors: 1 Total Number of Cores: 4 L2 Cache (per Core): 256 KB L3 Cache: 6 MB Memory: 16 GB Boot ROM Version: MBP101.00EE.B02 SMC Version (system): 2.3f32 Serial Number (system): C02HXBMSDKQ5 Hardware UUID: 0B42596B-3FA9-59DD-814E-AD141081775A

3 2

Re: [SmartcardServices-Users] [Fed-Talk] Updated smartcard installer?
by Randall P. Mora 17 Oct '12

17 Oct '12

Why isn't the CAC Card recognized in Mail.app or any browser. Notice that CAC-5FFF-7F00-62FF-00F0-B5D3 is being added to the keychain correctly (i.e., security list-keychains). Oct 17 09:14:35 graphite.local com.apple.SecurityServer[15]: Token reader OmniKey CardMan 3121 00 00 removed from system Oct 17 09:14:35 graphite.local com.apple.SecurityServer[15]: reader OmniKey CardMan 3121 00 00 removed token "CAC-5FFF-7F00-62FF-00F0-B5D3" (CAC-5FFF-7F00-62FF-00F0-B5D3) subservice 31 Oct 17 09:14:41 graphite.local com.apple.SecurityServer[15]: Token reader OmniKey CardMan 3121 00 00 inserted into system Oct 17 09:14:45 graphite.local com.apple.SecurityServer[15]: token inserted into reader OmniKey CardMan 3121 00 00 Oct 17 09:14:45 graphite.local com.apple.SecurityServer[15]: reader OmniKey CardMan 3121 00 00 inserted token "CAC-5FFF-7F00-69FF-00F0-0592" (CAC-5FFF-7F00-69FF-00F0-0592) subservice 32 using driver com.apple.tokend.cac Oct 17 09:15:23 graphite.local com.apple.SecurityServer[15]: Session 100022 created Oct 17 09:15:23 graphite.local com.apple.security.XPCKeychainSandboxCheck[708]: Can't get dir or base (likely out of memory) for CAC-5FFF-7F00-69FF-00F0-0592 Oct 17 09:16:53 graphite.local sandboxd[725] ([259]): WebProcess(259) deny file-read-data /Library/Preferences/com.apple.security-common.plist graphite:log rmora$ security list-keychains "CAC-5FFF-7F00-69FF-00F0-0592" "/Users/rmora/Library/Keychains/login.keychain" "/Users/rmora/Library/Keychains/Microsoft_Intermediate_Certificates" "/Users/rmora/Library/Application Support/Adobe/AIR/ELS/com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1/PrivateEncryptedDatak" "/System/Library/Keychains/SystemCACertificates.keychain" graphite:log rmora$ when trying to bring up mail: Oct 17 09:33:38 graphite.local Mail[864]: Using V2 Layout Oct 17 09:33:38 graphite.local com.apple.SecurityServer[15]: Session 100027 created Oct 17 09:33:38 graphite.local com.apple.security.XPCKeychainSandboxCheck[866]: Can't get dir or base (likely out of memory) for CAC-5FFF-7F00-69FF-00F0-A581 Oct 17 09:33:44 graphite.local Mail[864]: *** -[IADomainCache init]: IA domains cache is out of date. Oct 17 09:33:44 graphite.local SyncServer[868]: [0x7ff56940be40] |DataManager|Warning| Client com.apple.Mail sync alert tool path /System/Library/Frameworks/Message.framework/Resources/MailSync does not exist. THUS the Mail.app will not initialize the ability to digitally sign my emails then when bring up Safari.. Oct 17 09:34:47 graphite.local sandboxd[878] ([877]): WebProcess(877) deny file-read-data /Library/Preferences/com.apple.security-common.plist Oct 17 09:34:47 graphite kernel[0]: Sandbox: sandboxd(878) deny mach-lookup com.apple.coresymbolicationd And can't access the customers CAC enabled site. Software OS X 10.8.2 (12C60) Hardware Overview: Model Name: MacBook Pro Model Identifier: MacBookPro10,1 Processor Name: Intel Core i7 Processor Speed: 2.6 GHz Number of Processors: 1 Total Number of Cores: 4 L2 Cache (per Core): 256 KB L3 Cache: 6 MB Memory: 16 GB Boot ROM Version: MBP101.00EE.B02 SMC Version (system): 2.3f32 Serial Number (system): C02HXBMSDKQ5 Hardware UUID: 0B42596B-3FA9-59DD-814E-AD141081775A

1 0