<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">What I am looking for is the
configuration of the MacOSX client. When I monitor with
wireshark the only time I can see a pkinit AS_REQ is using the
commandline:<br>
<br>
kinit -C KEYCHAIN:<br>
<br>
But only after I have already unlocked the PIV keychain. <br>
<br>
The MacOSX 10.9.5 or 10.10 systems have an /etc/krb5.conf that has
the following pkinit configuration, under the realms stanza for
both an MIT KDC and Windows KDC who are enabled for pkinit. Note
you don't need the "krbtgt/realm@realm" in the KDC cert SAN if you
set pkinit_require_krbtgt_otherName to false:<br>
<br>
pkinit_identities = KEYCHAIN:<br>
pkinit_anchors=<a class="moz-txt-link-freetext" href="FILE:/usr/local/kerberos/config/etc/pkinit/certificates/trusted-ca">FILE:/usr/local/kerberos/config/etc/pkinit/certificates/trusted-ca</a><br>
pkinit_require_crl_checking = false<br>
pkinit_kdc_hostname = Hostname_of_KDC<br>
pkinit_cert_match =
&&<EKU>msScLogin,<KU>digitalSignature<br>
pkinit_cert_match = <SAN>.*@FEDIDCARD.GOV<br>
pkinit_require_krbtgt_otherName = false<br>
<br>
The problem is I never see pam_opendirectory or pam_krb5 make a
Kerberos authentication call (AS_REQ) using the PKINIT preauth
data (image below).<br>
<br>
After installing the smartcard services and doing the steps below,
I can use the PIV for login and for screenlock, but no Kerberos
calls take place.<br>
<ul>
<li>security authorizationdb smartcard enable</li>
<li>Insert smartcard for USER</li>
<li>sc_auth accept -u USER –k PIV</li>
</ul>
An Apple document talked about configuring
/etc/cacloginconfig.plist, which I did, but no change.<br>
<br>
So I am curious if anyone has it working outside of using the
kinit commandline?<br>
<br>
Thanks<br>
<br>
Glenn<br>
<br>
<br>
<br>
Kerberos AS_REQ using pkinit preauth data (padata):<br>
<br>
<img alt="" src="cid:part1.04020208.00010504@sandia.gov"
width="618" height="253"><br>
<br>
<br>
<br>
On 8/30/15 9:12 PM, Burgin, Thomas (NIH/NIMH) [C] wrote:<br>
</div>
<blockquote cite="mid:246A55C6-BB4F-49F7-A908-8E3ED6EDF185@nih.gov"
type="cite">
<pre wrap="">I have had success with PK-INIT using a Windows KDC after building a proper SAN for the KDC cert. I am using attribute matching for SmartCard login.
<a class="moz-txt-link-freetext" href="https://github.com/tburgin/SANBuilder">https://github.com/tburgin/SANBuilder</a>
I have not tried with an Open Directory server...
Sent from my iPhone
</pre>
<blockquote type="cite">
<pre wrap="">On Aug 30, 2015, at 9:22 PM, Glenn Machin <a class="moz-txt-link-rfc2396E" href="mailto:gmachin@sandia.gov"><gmachin@sandia.gov></a> wrote:
The only way I can see a Kerberos AS_REQ using PKINIT is using the command line "kinit -C KEYCHAIN:".
Has anyone got PKINIT working via OpenDirectory during login or via pam modules (pam_opendirectory or pam_krb5)?
Shame I don't see Apple publishing documents describing how to enable pkinit given federal government requirements for use of smartcards.
Seems like its the users helping users, while Apple keeps quiet.
Appreciate any help.
Glenn
_______________________________________________
SmartcardServices-Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:SmartcardServices-Users@lists.macosforge.org">SmartcardServices-Users@lists.macosforge.org</a>
<a class="moz-txt-link-freetext" href="https://lists.macosforge.org/mailman/listinfo/smartcardservices-users">https://lists.macosforge.org/mailman/listinfo/smartcardservices-users</a>
</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>