- SmartcardServices-Users - lists.macosforge.org

Question from a New Person Testing Smart Cards
by Will Coleman 25 Feb '11

25 Feb '11

Hi All, Thanks for putting this board together, it's extremely helpful. I have a question with an implementation I'm struggling with. I've setup a single server with both a CA / AD and DC configured. I am testing smartcards from JITC (Government Issues SmartCards) for a company that provides software for corporations that would like to use Active Directory for identity management on Macintosh. The crux of our solution allows users to be provisioned in Active Directory and then have the ability to login using those credentials into their Macs. My test environment is setup properly and I am able to successfully login via a windows machine using the Gov't issued smartcard into my local Active Directory instance (separately, I'm able to login using my Mac with an Active Directory supplied username and password). However, there is a small problem, the govt issued smartcards themselves seem to have "two identities", one is a "NT Principle Name ID" (I believe) and the other is a PIV credential (with several additional numbers following the NT Principle Name. The default sign-on credential is the PIV and in windows you can switch to another identity and successfully login to the Windows machine. If you want to get an idea of what I'm talking about – take a look at these set of pictures I've posted on photobucket (I've scrubbed them of specific ID's) Here is the album with the three photos that are annotated – I think this will make much more sense for everyone. Hopefully everyone understands photobucket. http://s1097.photobucket.com/albums/g355/wqcoleman/Smart%20Card%20Login%20O… Macintosh unfortunately picks the default credential, in this case, PIV, which means I am unable to login using the smartcard – since I can't provision the ID in AD to work – I get a "credentials cannot be verified when I try to login using the PIN". I have the advantage of selected the proper credentials in Windows 7, but again, Mac does not allow this and I'm sure there is some configuration in either Mac, Active Directory or somewhere that will either 1) force the credentials that is working for login (see picture with the NT Principle Name) or 2) allow me to provision the PIV credential into AD and allow for the user to login? Please accept my apologies for not using the proper nomenclature, I'm learning this as fast as I can and it's been a crash course in smartcards, certs, etc.. Thanks in advance for any help, -- William Q. Coleman Centrify Corporation

2 13

Re: [SmartcardServices-Users] of Oberthur 128 cards
by John Daly 24 Feb '11

24 Feb '11

Greetings all, I note that there have been no changes in the software for almost a year. Is there any idea of when we might get the capability to use the Oberthur 128 v5.5 CAC cards? I have a growing number of people who have them and are getting very frustrated with the "you can't get there from a Mac" answer. Thank you, John

4 7

CAC Login and pkinit
by David Bruno (Civ ARL/CISD) <dbruno> 23 Feb '11

23 Feb '11

Hello, I have two questions. 1. Based on reading posts from this list and in other places, we have pieced together a cac login solution using the pubkeyhash method. We do not currently have a directory service implemented. However, I¹m curious if there is a way to utilize attribute matching with the local directory service on a MAC OS 10.6.6 client? The pubkeyhash cac login option is working great, however we would like to implement a solution where the AuthenticationAuthority field does not need to be updated every time a user is given a new smartcard. 2. I read a few posts about pkinit being available in 10.6.2 and later, and specifically a security vulnerability with pkinit which was fixed in 10.6.6. I just want to verify that the security vulnerability has been patched. Also I have not been able to successfully implement the method described in this post: http://lists.macosforge.org/pipermail/smartcardservices-users/2010-July/0001 17.html by Shawn Geddis - I¹ve been using the command: /System/Library/PrivateFrameworks/Heimdal.frameworks/Helpers/kinit C KEYCHAIN: -D: KEYCHAIN: --pk-enterprise for testing as described in the post above, however when I use -pk-enterprise option it connects to our KDC requesting a ticket for the PersonIdentifier\@mil instead of asking for my username like username@realm. When I use the -enterprise option instead of pk-enterprise it correctly asks our KDC for a ticket for username@realm. However I keep getting PREAUTH_FAILED errors. Also if we do get the test command working with the enterprise instead of pk-enterprise, is that still a valid test for getting a kerberos ticket at login with a smartcard? As a side note just running kinit works fine with no issues. Our linux machines have pkinit working with a subject mapping to the common name on the card to their linux username. Is there a way to do a subject mapping like this in OS 10.6.6? Please excuse any terms I messed up I¹m another person who has been getting a crash course in smart cards. Any help would be greatly appreciated. Thank you _______________________ David Bruno Security +, RHCT, CCNA, CCA ARL/CISD 410-278-8929 david.bruno(a)us.army.mil

1 0

Did CAC-NG make the trunk for SL or not?
by Miller, Timothy J. 17 Feb '11

17 Feb '11

I thought it had, but I noticed today that a coworker's Gemalto 144K card doesn't work right (shows in Keychains, but no certs). Comment? -- T

3 4

PCSC still not working with 64bit Java on OS X 10.6.6
by Clemens Orthacker 15 Feb '11

15 Feb '11

Hello all, We are still experiencing a problem we already reported in 2009: http://lists.macosforge.org/pipermail/smartcardservices-users/2009-Septembe… It seems there also is an open ticket for this issue: http://smartcardservices.macosforge.org/trac/ticket/47 As described in our previous post, Java (via smartcardIO/JNI, 64bit) finds the terminal but no card. Below is the output from pcscd. It seems to be blocked in winscard.c:199:SCardEstablishContext() Establishing Context: 17019343 [0x0103B1CF] Is this a known issue? Will there be a resolution? Please let me know if any further logging is required. Any help is appreciated. Thanks, Clemens $ sudo /usr/sbin/pcscd -fd /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/debuglog.c:240:DebugLogSetLevel() debug level=debug /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:585:main() pcsc-lite 1.4.0 daemon ready. /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:1545:ReaderCheckArchitecture() Send respawn signal to pcscd (pid=4441) /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:678:signal_respawn() Got signal to respawn in 32 bit mode /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:294:SVCServiceRunLoop() Preparing to exit... /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:1048:RFCleanupReaders() entering cleaning function /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/debuglog.c:240:DebugLogSetLevel() debug level=debug /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:585:main() pcsc-lite 1.4.0 daemon ready. /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:781:RFInitializeReader() Attempting startup of Gemplus GemPC Twin 00 00 using /usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:507:RFBindFunctions() Binding driver functions /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:643:RFBindFunctions() Loading IFD Handler 3.0 /SourceCache/SmartcardCCID/SmartcardCCID-35253/ccid/ccid/src/ifdhandler.c:1323:init_driver() Driver version: 1.3.8 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg_srv.c:217:SHMProcessEventsServer() Common channel packet arrival /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg_srv.c:226:SHMProcessEventsServer() SHMProcessCommonChannelRequest detects: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:256:SVCServiceRunLoop() A new context thread creation is requested: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_svc.c:178:ContextThread() Thread is started: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:119:SHMClientReadMessage() SHMClientReadMessage: Issuing read for 48 bytes (header) /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:500:SHMMessageReceive() SHMMessageReceive errno: 0x00000000: no error /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:501:SHMMessageReceive() SHMMessageReceive retval: 0x00000000, bytes read: 48 <== SHMMessageReceive: 12 34 56 78 00 00 00 3C 00 00 00 F8 00 00 01 F6 00 00 00 14 00 00 00 F8 4D 5A 8C 7B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:122:SHMClientReadMessage() SHMClientReadMessage: read message header error: 0x00000000 [0x00000000] /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:148:SHMClientReadMessage() SHMClientReadMessage: Issuing read for 12 bytes /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:500:SHMMessageReceive() SHMMessageReceive errno: 0x00000000: no error /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:501:SHMMessageReceive() SHMMessageReceive retval: 0x00000000, bytes read: 12 <== SHMMessageReceive: 00 00 00 03 00 00 00 00 5F C0 AE 41 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:153:SHMClientReadMessage() SHMClientReadMessage: read message body error: 0x00000000 [0x00000000] /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg_srv.c:293:SHMProcessEventsContext() correctly processed client: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_svc.c:242:ContextThread() Client is protocol version 3:0 ==> SHMMessageSend: 12 34 56 78 00 00 00 3C 00 00 00 F8 00 00 01 F6 00 00 00 14 00 00 00 F8 4D 5A 8C 7B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:119:SHMClientReadMessage() SHMClientReadMessage: Issuing read for 48 bytes (header) /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:500:SHMMessageReceive() SHMMessageReceive errno: 0x00000000: no error /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:501:SHMMessageReceive() SHMMessageReceive retval: 0x00000000, bytes read: 48 <== SHMMessageReceive: 12 34 56 78 00 00 00 3C 00 00 00 F1 00 00 01 F6 00 00 00 14 00 00 00 01 4D 5A 8C 7B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:122:SHMClientReadMessage() SHMClientReadMessage: read message header error: 0x00000000 [0x00000000] /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:148:SHMClientReadMessage() SHMClientReadMessage: Issuing read for 12 bytes /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:500:SHMMessageReceive() SHMMessageReceive errno: 0x00000000: no error /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:501:SHMMessageReceive() SHMMessageReceive retval: 0x00000000, bytes read: 12 <== SHMMessageReceive: 00 00 00 00 00 00 00 00 00 00 00 00 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg.cpp:153:SHMClientReadMessage() SHMClientReadMessage: read message body error: 0x00000000 [0x00000000] /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard_msg_srv.c:293:SHMProcessEventsContext() correctly processed client: 7 /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/winscard.c:199:SCardEstablishContext() Establishing Context: 17019343 [0x0103B1CF] ==> SHMMessageSend: 12 34 56 78 00 00 00 3C 00 00 00 F1 00 00 01 F6 00 00 00 14 00 00 00 01 4D 5A 8C 7B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 03 B1 CF 00 00 00 00

1 0

Re: [SmartcardServices-Users] [Fed-Talk] Re: Require smart card login
by Shawn A. Geddis 21 Jan '11

21 Jan '11

Paul, Organizations apply policy such as requiring smart cards by managing their AD. This is not something that they would do at the client side. What is managed on the client side would be any necessary mods to support the required authentication methods (ie. manage or install client side middleware such your ADmitMac for CAC). The Mac would be bound to AD (for Authentication and Authorization) hence if AD requires ONLY Smart Cards then the Mac User would only be able to authenticate via smart cards. Whether the client system is OS X or Windows the end result is the same --- management of forced authentication methods is at the Directory Service. - Shawn _____________________________________________________ Shawn Geddis - Security Consulting Engineer - Apple Enterprise On Oct 13, 2010, at 3:24 PM, Paul Nelson wrote: > Shawn, > > How does one apply organizational policies such as "smart card required" to the Apple 10.6.3+ PKINIT solution? > > Paul > > On Oct 13, 2010, at 2:01 PM, Shawn A. Geddis wrote: > >> Before everyone claims what is and isn't the issue, we need to understand the actual setup that Souheil is using. >> >> Souheil, >> >> There are multiple methods supported for using Smart Cards for Authentication & SSO on Mac OS X 10.6. >> >> What method are you using today ? >> >> Old methods still supported: >> - PubKeyHash >> - This is a simple Hash matching between card and account >> - The user is then presented with a PIN Challenge which >> wraps/unwraps/verifies challenge - uses Private key on Card to prove ownership of card >> - uses sc_auth to update the DS with appropriate ";pubkeyhash;" and <hash> entries >> - Attribute Matching >> - This allows for selective attributes from Smart Card Login Certificate (ie. NT Principal Name) >> to be used for mapping to a single DS attribute (ie. UserPrincipalName) >> - uses /etc/cacloginconfig.plist mapping to define lookup in DS >> >> >> Mac OS X 10.6.3+ >> - PKINIT (initialization of Kerberos Session [TGT] with Auth from X.509 Cert) >> - SSO to Directory Service of choice (ie. AD) >> simplified explanation of process >> - System Bound to DS (ie. AD) >> - Utilizes NT Principal Name along with the Cert with EKU of Smart Card Login ( 1 3 6 1 4 1 311 20 2 2 ) >> --relies on /etc/cacloginconfig.plist to reference the NTPrincipalName >> - Request for Auth to KDC - acquires a TGT >> - uses PKINITMechanism configured in /etc/authorization/ for Login and ScreenSaver >> - Success: Access to HomeDir and subsequent Service Tickets >> - ... life continues ... >> >> Also, copying SmartCardServices-Users Mailing List where this discussion should be taking place >> >> - Shawn >> _____________________________________________________ >> Shawn Geddis - Security Consulting Engineer - Apple Enterprise >> >> >> On Oct 13, 2010, at 2:00 PM, Paul Nelson wrote: >>> You probably are not configured to verify the user's smart card credentials with AD. The Mac only matches the user account, and checks the certs to see if they are trusted. >>> >>> If you want true AD login with single sign-on, you could check out Thursby's ADmitMac PKI. This software obtains Kerberos credentials using a PIV card, and will configure itself using group policy so that you can enforce smart card logon that way. It also configures your system keychain with necessary certificates from Active Directory and group policy. >>> >>> Paul Nelson >>> Thursby Software Systems, Inc. >>> >>> On Oct 13, 2010, at 12:14 PM, Inati, Souheil (NIH/NIMH) [E] wrote: >>> >>>> These machines are bound to the NIH active directory and I only care about domain users for now. I haven't had to use sc_auth, the AD lookup based on the card credentials has been working fine. >>>> >>>> >>>> On Oct 13, 2010, at 12:51 PM, Qureshi, Usman wrote: >>>> >>>>> Have you tried using the sc_auth command? Is the user a domain user or a >>>>> local user? >>>>> >>>>> -----Original Message----- >>>>> From: fed-talk-bounces+usman.qureshi=unisys.com(a)lists.apple.com >>>>> [mailto:fed-talk-bounces+usman.qureshi=unisys.com@lists.apple.com] On Behalf >>>>> Of Inati, Souheil (NIH/NIMH) [E] >>>>> Sent: Wednesday, October 13, 2010 12:15 PM >>>>> To: fed-talk(a)lists.apple.com >>>>> Subject: [Fed-Talk] Require smart card login >>>>> >>>>> Hi all, >>>>> >>>>> Does anyone know the right way to set up /etc/authorization so that users >>>>> are REQUIRED to use a smart card? >>>>> A Snow Leopard 10.6 only solution is sufficient. >>>>> >>>>> Thanks, >>>>> Souheil

7 9

FW: [Fed-Talk] PKI Certificate ³Name Constraints² extension treated as an unknown critical extension
by Dan O'Donnell 03 Jan '11

03 Jan '11

Cross-posted as relevant to Smart Card Services from Apple Fed-talk. ------ Forwarded Message From: "Disiena, Ridley J. (GRC-VO00)[DB Consulting Group, Inc.]" <obscured> Date: Mon, 3 Jan 2011 14:34:52 -0600 To: "fed-talk(a)lists.apple.com" <fed-talk(a)lists.apple.com> Subject: [Fed-Talk] PKI Certificate ³Name Constraints² extension treated as an unknown critical extension Issue: OS X 10.5.x & 10.6.x treats the ³Name Constraints² extension as an unknown critical extension and therefore treats the certificate as invalid due to "unrecognized critical extension". I know there are previous threads on this subject for current live certificates of particular agencies and DoD and we know that this issue is because OS X does not recognize the extension yet. I'm bringing this back up on the list because due this issue is likely to plague Federal OS X users and their customers for the foreseeable future until resolved by Apple since several proposed new Federal Bridge Certificates will likely have such a critical extension. This is news to me since the last posting on the subject, I had hoped newly issues certificates would not be effected but at this time that appears that will not be the case. Complications: Since the effected Federal Bridge cross certificates will be found in the PKCS#7 bundles found via validation of AIA locations of Federal Agency certificates, applications that use OS X¹s certificate security functionality including the OS X operating system itself, will treat certificates that are valid, falsely as invalid due to very outdated libraries. As mentioned in a previous post, the openSSL library has been updated to recognize and use the Critical Name Extension as of 0.9.8 released 5 years ago, and the PKI definition of the ³Name Constraints² extension is now 12 years old. If this is the case, this is not an issue with the certificates, it is a case of severely out dated PKI libraries in OS X. I have put in a bug report [which will likely get sent back as duplicate and closed] and am following up with Enterprise Support but since this issue has been occurring for 2 OS versions already with no response from Apple on related posts, I wanted to make the other Federal folks involved with PKI aware, that at this time, it appears we will be effected for the foreseeable future, until Apple addresses the issue. FPKI is being made aware of the issue but in looking at how long ago these extensions were defined in best practices documentation, it looks like the issue is on the Apple side, with OS X failing to recognize / utilize recent libraries, and not so recent standards. Related Fed-Talk Posts: Related name constraints noted on Fed-Talk April 2010 PKI Certificates - Unknown Critical Extensions causing problems... http://lists.apple.com/archives/fed-talk/2010/Apr/msg00005.html http://lists.apple.com/archives/fed-talk/2010/Apr/msg00006.html ³Also, it looks like the *key* security binaries and/or Frameworks are *STATICALLY* linked to the 'old' OpenSSL libraries² Related name constraints noted on Fed-Talk December 2010 http://lists.apple.com/archives/fed-talk/2010/Apr/msg00008.html http://lists.apple.com/archives/fed-talk/2010/Nov/msg00177.html Related policy constraints noted on Fed-Talk October 2009 http://lists.apple.com/archives/apple-cdsa/2009/Oct/msg00002.html Backup Information: OpenSSL 0.9.8 released Tue, 05 Jul 2005 [ Over 5 years ago ] http://www.mail-archive.com/openssl-announce@openssl.org/msg00063.html ---> * Added support for certificate policy mappings, policy constraints and name constraints. <--- IETF Document Definition of ³Name Constraints² extension: January 1999 [12 Years ago] http://www.ietf.org/rfc/rfc2459.txt Housley, et. al. Standards Track [Page 34] RFC 2459 Internet X.509 Public Key Infrastructure January 1999 ---> 4.2.1.11 Name Constraints ------ End of Forwarded Message __________________________________________________________________________ This email message is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

1 0

Supported Cards
by Bernardo Hoehl 22 Dec '10

22 Dec '10

Hi list, This is my first post. I am looking for a list of supported cards. Can anyone help me? Thank you, Bernardo Höhl Rio de Janeiro

1 0

Issue with CAC on Snow Leopard
by Charles Victory 23 Nov '10

23 Nov '10

Hello, I have a SCR3310 device and am using a GEMALTO ACCESS 64KV2 CAC. I have downloaded and installed CAC-NG (BETA v0.95)/Snow Leopard from http://smartcardservices.macosforge.org/trac/wiki/installers. I can now see my CAC certificates on the CAC Keychain where I could not before this step. That is great, however the 4 certificates I have are all showing that they have invalid issuers. When I show the certificate after evaluating it, it shows that the DoD Interoperability Root Ca 1 and DoD Root Ca 2 cannot be used due to unrecognized critical extensions. This shows up when I go to use Outlook 2011 for Mac and it will not allow me to digitally sign or encrypt my e-mail. I don¹t think it is a CAC issue because when I use the CAC on my old XP PC using Outlook 2003, I am able to digitally sign and encrypt my e-mail there. Can someone provide some insight as to what my issue may be?? Thanks in advance, Charlie Victory

3 3

Gemalto GemPC key no longer works
by Tim Nowaczyk 28 Oct '10

28 Oct '10

Hello all, I hope this is the right list for getting help with my issue. If not, I apologize, but hope someone can point me to the correct list. We use the Gemalto GemPC USB token at the University of Virginia. After the last OS X update install on Monday, These tokens no longer work on my computer. That could just be a coincidence, though. I have tried both my own and a colleague's token without success. My token does work, however, in my windows VM, so I know that the token itself is good. When I plug in my token, I see the following in the console messages. 10/28/10 [Oct 28] 10:57:12 AM com.apple.securityd[27] /SourceCache/SmartcardCCID/SmartcardCCID-35253/ccid/ccid/src/ifdhandler.c:1323:init_driver() Driver version: 1.3.8 and it prints the following often when I unplug it. 10/28/10 [Oct 28] 10:58:13 AM com.apple.securityd[27] /SourceCache/SmartcardCCID/SmartcardCCID-35253/ccid/ccid/src/ccid_usb.c:489:WriteUSB() usb_bulk_write(004/003-08e6-3438-00-00): Operation timed out 10/28/10 [Oct 28] 10:58:13 AM com.apple.securityd[27] /SourceCache/SmartcardCCID/SmartcardCCID-35253/ccid/ccid/src/ccid_usb.c:489:WriteUSB() usb_bulk_write(004/003-08e6-3438-00-00): Operation timed out Sometimes the previous usb_bulk_write line is spewed over and over after plugging in the token. I have run pcscd in debugging mode once with apdu logging and once without. I didn't know if apdu would be useful here. -- Timothy Nowaczyk Network Systems Engineer University of Virginia - ITC tan7f(a)virginia.edu

1 0