Procedure

1. Create a directory in which you will do the configuration:

   [root@server]# mkdir ~/SmartCard/

2. Navigate to the directory:

   [root@server]# cd ~/SmartCard/

3. Obtain the relevant CA certificates stored in files in PEM format. If your CA certificate is stored in a file of a different format, such as DER, convert it to PEM format. The IdM Certificate Authority certificate is located in the /etc/ipa/ca.crt file.

   Convert a DER file to a PEM file:

   # openssl x509 -in <filename>.der -inform DER -out <filename>.pem -outform PEM

4. For convenience, copy the certificates to the directory in which you want to do the configuration:

   [root@server SmartCard]# cp /etc/ipa/ca.crt ~/SmartCard/
   [root@server SmartCard]# cp /tmp/smartcard_ca.pem ~/SmartCard/

5. Optionally, if you use certificates of external certificate authorities, use the openssl x509 utility to view the contents of the files in the PEM format to check that the Issuer and Subject values are correct:

   [root@server SmartCard]# openssl x509 -noout -text -in smartcard_ca.pem | more

6. Generate a configuration script with the in-built ipa-advise utility, using the administrator’s privileges:

   [root@server SmartCard]# kinit admin
   [root@server SmartCard]# sudo ipa-advise config-server-for-smart-card-auth > config-server-for-smart-card-auth.sh

   The config-server-for-smart-card-auth.sh script performs the following actions:

   • It configures the IdM Apache HTTP Server.
   • It enables Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) on the Key Distribution Center (KDC).
   • It configures the IdM Web UI to accept smart card authorization requests.

7. Execute the script, adding the PEM files containing the root CA and sub CA certificates as arguments:

   [root@server SmartCard]# chmod +x config-server-for-smart-card-auth.sh
   [root@server SmartCard]# ./config-server-for-smart-card-auth.sh smartcard_ca.pem ca.crt
   Ticket cache:KEYRING:persistent:0:0
   Default principal: admin@IDM.EXAMPLE.COM
   [...]
   Systemwide CA database updated.
   The ipa-certupdate command was successful

   Note

   Ensure that you add the root CA’s certificate as an argument before any sub CA certificates and that the CA or sub CA certificates have not expired.

8. Optionally, if the certificate authority that issued the user certificate does not provide any Online Certificate Status Protocol (OCSP) responder, you may need to disable OCSP check for authentication to the IdM Web UI:

   1. Set the SSLOCSPEnable parameter to off in the /etc/httpd/conf.d/ssl.conf file:

      SSLOCSPEnable off

   2. Restart the Apache daemon (httpd) for the changes to take effect immediately:

      [root@server SmartCard]# sudo systemctl restart httpd

   Warning

   Do not disable the OCSP check if you only use user certificates issued by the IdM CA. OCSP responders are part of IdM.

   For instructions on how to keep the OCSP check enabled, and yet prevent a user certificate from being rejected by the IdM server if it does not contain the information about the location at which the CA that issued the user certificate listens for OCSP service requests, see the SSLOCSPDefaultResponder directive in Apache mod_ssl configuration options.

Procedure

1. On an IdM master, generate a configuration script with ipa-advise using the administrator’s privileges:

   [root@server SmartCard]# kinit admin
   [root@server SmartCard]# ipa-advise config-client-for-smart-card-auth > config-client-for-smart-card-auth.sh

   The config-client-for-smart-card-auth.sh script performs the following actions:

   • It configures the smart card daemon.
   • It sets the system-wide trust store.
   • It configures the System Security Services Daemon (SSSD) to allow smart card logins to the desktop.

2. From the IdM master, copy the script to a directory of your choice on the IdM client machine:

   [root@server SmartCard]# scp config-client-for-smart-card-auth.sh root@client.idm.example.com:/root/SmartCard/
   Password:
   config-client-for-smart-card-auth.sh        100%   2419       3.5MB/s   00:00

3. From the IdM master, copy the CA certificate files in the PEM format for convenience to the same directory on the IdM client machine as used in the previous step:

   [root@server SmartCard]# scp {smartcard_ca.pem,ca.crt} root@client.idm.example.com:/root/SmartCard/
   Password:
   smartcard_ca.pem                    100%   1237     9.6KB/s   00:00
   ca.crt                              100%   2514    19.6KB/s   00:00

4. On the client machine, execute the script, adding the PEM files containing the CA certificates as arguments:

   [root@client SmartCard]# kinit admin
   [root@client SmartCard]# chmod +x config-client-for-smart-card-auth.sh
   [root@client SmartCard]# ./config-client-for-smart-card-auth.sh smartcard_ca.pem ca.crt
   Ticket cache:KEYRING:persistent:0:0
   Default principal: admin@IDM.EXAMPLE.COM
   [...]
   Systemwide CA database updated.
   The ipa-certupdate command was successful

   Note

   Ensure that you add the root CA’s certificate as an argument before any sub CA certificates and that the CA or sub CA certificates have not expired.

Procedure

1. Install the opensc and gnutls-utils packages:

   # dnf -y install opensc gnutls-utils

2. Start the pcscd service.

   # systemctl start pcscd

Procedure

1. Erase your smart card and authenticate yourself with your PIN:

   $ pkcs15-init --erase-card --use-default-transport-keys
   Using reader with a card: Reader name
   PIN [Security Officer PIN] required.
   Please enter PIN [Security Officer PIN]:

   The card has been erased.

2. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:

   $ pkcs15-init --create-pkcs15 --use-default-transport-keys \
       --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123
   Using reader with a card: Reader name

   The pcks15-init tool creates a new slot on the smart card.

3. Set the label and the authentication ID for the slot:

   $ pkcs15-init --store-pin --label testuser \
       --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478
   Using reader with a card: Reader name

   The label is set to a human-readable value, in this case, testuser. The auth-id must be two hexadecimal values, in this case it is set to 01.

4. Store and label the private key in the new slot on the smart card:

   $ pkcs15-init --store-private-key testuser.key --label testuser_key \
       --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   The value you specify for --id must be the same when storing your private key, and certificate. If you do not specify a value for --id, a more complicated value is calculated by the tool and it is therefore easier to define your own value.

5. Store and label the certificate in the new slot on the smart card:

   $ pkcs15-init --store-certificate testuser.crt --label testuser_crt \
       --auth-id 01 --id 01 --format pem --pin 963214
   Using reader with a card: Reader name

6. (Optional) Store and label the public key in the new slot on the smart card:

   $ pkcs15-init --store-public-key testuserpublic.key
       --label testuserpublic_key --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   If the public key corresponds to a private key and/or certificate, you should specify the same ID as that private key and/or certificate.

7. (Optional) Some smart cards require you to finalize the card by locking the settings:

   $ pkcs15-init -F

   At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.

Procedure

1. Open the IdM Web UI in the browser.

2. Click on Log In Using Certificate.

   

3. If the Password Required dialog box opens, add the PIN to unlock the smart card and click the OK button.

   The User Identification Request dialog box opens.

   If the smart card contains more than one certificate, select the certificate you want to use for authentication in the drop down list below Choose a certificate to present as identification.

4. Click the OK button.

Procedure

1. Insert the smart card in the reader.
2. Enter the smart card PIN.
3. Click Sign In.

Procedure

1. Connect from the IdM server and copy the adcs-winserver-ca.cer root certificate to the IdM server:

   root@idmserver ~]# sftp Administrator@winserver.ad.example.com
   Administrator@winserver.ad.example.com's password:
   Connected to Administrator@winserver.ad.example.com.
   sftp> cd <Path to certificates>
   sftp> ls
   adcs-winserver-ca.cer    aduser1.pfx
   sftp>
   sftp> get adcs-winserver-ca.cer
   Fetching <Path to certificates>/adcs-winserver-ca.cer to adcs-winserver-ca.cer
   <Path to certificates>/adcs-winserver-ca.cer                 100%  1254    15KB/s 00:00
   sftp quit

2. Connect from the IdM client and copy the aduser1.pfx user certificate to the client:

   [root@client1 ~]# sftp Administrator@winserver.ad.example.com
   Administrator@winserver.ad.example.com's password:
   Connected to Administrator@winserver.ad.example.com.
   sftp> cd /<Path to certificates>
   sftp> get aduser1.pfx
   Fetching <Path to certificates>/aduser1.pfx to aduser1.pfx
   <Path to certificates>/aduser1.pfx                 100%  1254    15KB/s 00:00
   sftp quit

Procedure

1. On the IdM server, use the ipa-advise script for configuring a client:

   [root@idmserver ~]# ipa-advise config-client-for-smart-card-auth > sc_client.sh

2. On the IdM server, use the ipa-advise script for configuring a server:

   [root@idmserver ~]# ipa-advise config-server-for-smart-card-auth > sc_server.sh

3. On the IdM server, execute the script:

   [root@idmserver ~]# sh -x sc_server.sh adcs-winserver-ca.cer

   • It configures the IdM Apache HTTP Server.
   • It enables Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) on the Key Distribution Center (KDC).
   • It configures the IdM Web UI to accept smart card authorization requests.

4. Copy the sc_client.sh script to the client system:

   [root@idmserver ~]# scp sc_client.sh root@client1.idm.example.com:/root
   Password:
   sc_client.sh                  100%  2857   1.6MB/s   00:00

5. Copy the Windows certificate to the client system:

   [root@idmserver ~]# scp adcs-winserver-ca.cer root@client1.idm.example.com:/root
   Password:
   adcs-winserver-ca.cer                 100%  1254   952.0KB/s   00:00

6. On the client system, run the client script:

   [root@idmclient1 ~]# sh -x sc_client.sh adcs-winserver-ca.cer

Procedure

1. On the IdM client, into the PEM format:

   [root@idmclient1 ~]# openssl pkcs12 -in aduser1.pfx -out aduser1_cert_only.pem -clcerts -nodes
   Enter Import Password:

2. Extract the key into the separate file:

   [root@idmclient1 ~]# openssl pkcs12 -in adduser1.pfx -nocerts -out adduser1.pem > aduser1.key

3. Extract the public certificate into the separate file:

   [root@idmclient1 ~]# openssl pkcs12 -in adduser1.pfx -clcerts -nokeys -out aduser1_cert_only.pem > aduser1.crt

Procedure

1. Install the opensc and gnutls-utils packages:

   # dnf -y install opensc gnutls-utils

2. Start the pcscd service.

   # systemctl start pcscd

Procedure

1. Erase your smart card and authenticate yourself with your PIN:

   $ pkcs15-init --erase-card --use-default-transport-keys
   Using reader with a card: Reader name
   PIN [Security Officer PIN] required.
   Please enter PIN [Security Officer PIN]:

   The card has been erased.

2. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:

   $ pkcs15-init --create-pkcs15 --use-default-transport-keys \
       --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123
   Using reader with a card: Reader name

   The pcks15-init tool creates a new slot on the smart card.

3. Set the label and the authentication ID for the slot:

   $ pkcs15-init --store-pin --label testuser \
       --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478
   Using reader with a card: Reader name

   The label is set to a human-readable value, in this case, testuser. The auth-id must be two hexadecimal values, in this case it is set to 01.

4. Store and label the private key in the new slot on the smart card:

   $ pkcs15-init --store-private-key testuser.key --label testuser_key \
       --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   The value you specify for --id must be the same when storing your private key, and certificate. If you do not specify a value for --id, a more complicated value is calculated by the tool and it is therefore easier to define your own value.

5. Store and label the certificate in the new slot on the smart card:

   $ pkcs15-init --store-certificate testuser.crt --label testuser_crt \
       --auth-id 01 --id 01 --format pem --pin 963214
   Using reader with a card: Reader name

6. (Optional) Store and label the public key in the new slot on the smart card:

   $ pkcs15-init --store-public-key testuserpublic.key
       --label testuserpublic_key --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   If the public key corresponds to a private key and/or certificate, you should specify the same ID as that private key and/or certificate.

7. (Optional) Some smart cards require you to finalize the card by locking the settings:

   $ pkcs15-init -F

   At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.

Procedure

1. Open the sssd.conf file:

   [root@idmclient1 ~]# vim /etc/sssd/sssd.conf

2. Change the value of p11_child_timeout:

   [pam]
   p11_child_timeout = 60

3. Change the value of krb5_auth_timeout:

   [domain/IDM.EXAMPLE.COM]
   krb5_auth_timeout = 60

4. Save the settings.

Procedure

1. Obtain the user information from the certificate. Use the openssl x509 certificate display and signing utility with:

   • the -noout option to prevent the output of an encoded version of the request
   • the -issuer option to output the issuer name
   • the -in option to specify the input file name to read the certificate from

   • the -nameopt option with the RFC2253 value to display the output with the most specific relative distinguished name (RDN) first

     If the input file contains an Identity Management certificate, the output of the command shows that the Issuer is defined using the Organisation information:

     # openssl x509 -noout -issuer -in idm_user.crt -nameopt RFC2253
     issuer=CN=Certificate Authority,O=REALM.EXAMPLE.COM

     If the input file contains an Active Directory certificate, the output of the command shows that the Issuer is defined using the Domain Component information:

     # openssl x509 -noout -issuer -in ad_user.crt -nameopt RFC2253
     issuer=CN=AD-WIN2012R2-CA,DC=AD,DC=EXAMPLE,DC=COM

2. Optionally, to create a new mapping rule in the CLI based on a matching rule which specifies that the certificate issuer must be the extracted AD-WIN2012R2-CA of the ad.example.com domain and the subject on the certificate must match the certmapdata entry in a user account in IdM:

   # ipa certmaprule-add simple_rule --matchrule '<ISSUER>CN=AD-WIN2012R2-CA,DC=AD,DC=EXAMPLE,DC=COM' --maprule '(ipacertmapdata=X509:<I>{issuer_dn!nss_x500}<S>{subject_dn!nss_x500})'

Procedure

1. Create a directory where you can generate the certificate, for example:

   # mkdir /tmp/ca
   # cd /tmp/ca

2. Set up the certificate (copy this text to your command line in the ca directory):

   cat > ca.cnf <<EOF
   [ ca ]
   default_ca = CA_default
   
   [ CA_default ]
   dir              = .
   database         = \$dir/index.txt
   new_certs_dir    = \$dir/newcerts
   
   certificate      = \$dir/rootCA.crt
   serial           = \$dir/serial
   private_key      = \$dir/rootCA.key
   RANDFILE         = \$dir/rand
   
   default_days     = 365
   default_crl_days = 30
   default_md       = sha256
   
   policy           = policy_any
   email_in_dn      = no
   
   name_opt         = ca_default
   cert_opt         = ca_default
   copy_extensions  = copy
   
   [ usr_cert ]
   authorityKeyIdentifier = keyid, issuer
   
   [ v3_ca ]
   subjectKeyIdentifier   = hash
   authorityKeyIdentifier = keyid:always,issuer:always
   basicConstraints       = CA:true
   keyUsage               = critical, digitalSignature, cRLSign, keyCertSign
   
   [ policy_any ]
   organizationName       = supplied
   organizationalUnitName = supplied
   commonName             = supplied
   emailAddress           = optional
   
   [ req ]
   distinguished_name = req_distinguished_name
   prompt             = no
   
   [ req_distinguished_name ]
   O  = Example
   OU = Example Test
   CN = Example Test CA
   EOF

3. Create the following directories:

   # mkdir certs crl newcerts

4. Create the following files:

   # touch index.txt crlnumber index.txt.attr

5. Write the number 01 in the serial file:

   # echo 01 > serial

   This command writes a number 01 in the serial file. It is a serial number of the certificate. With each new certificate released by this CA the number increases by one.

6. Create an OpenSSL root CA key:

   # openssl genrsa -out rootCA.key 2048

7. Create a self-signed root Certification Authority certificate:

   # openssl req -batch -config ca.cnf \
       -x509 -new -nodes -key rootCA.key -sha256 -days 10000 \
       -set_serial 0 -extensions v3_ca -out rootCA.crt

8. Create the key for your username:

   # openssl genrsa -out example.user.key 2048

   This key is generated in the local system which is not secure, therefore, remove the key from the system when the key is stored in the card.

   You can create a key directly in the smart card as well. For doing this, follow instructions created by the manufacturer of your smart card.

9. Create the certificate signing request configuration file (copy this text to your command line in the ca directory):

   cat > req.cnf <<EOF
   [ req ]
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   O = Example
   OU = Example Test
   CN = testuser
   
   [ req_exts ]
   basicConstraints = CA:FALSE
   nsCertType = client, email
   nsComment = "testuser"
   subjectKeyIdentifier = hash
   keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = clientAuth, emailProtection, msSmartcardLogin
   subjectAltName = otherName:msUPN;UTF8:testuser@EXAMPLE.COM, email:testuser@example.com
   EOF

10. Create a certificate signing request for your example.user certificate:

    # openssl req -new -nodes -key example.user.key \
        -reqexts req_exts -config req.cnf -out example.user.csr

11. Configure the new certificate. Expiration period is set to 1 year:

    # openssl ca -config ca.cnf -batch -notext \
        -keyfile rootCA.key -in example.user.csr -days 365 \
        -extensions usr_cert -out example.user.crt

Procedure

1. Ensure that you have SSSD installed on the system.

   # rpm -q sssd
   sssd-2.0.0.43.el8_0.3.x86_64

2. Create a /etc/sssd/pki directory:

   # file /etc/sssd/pki
   /etc/sssd/pki/: directory

3. Copy the rootCA.crt as a PEM file in the /etc/sssd/pki/ directory:

   # cp /tmp/ca/rootCA.crt /etc/sssd/pki/sssd_auth_ca_db.pem

Procedure

1. Install the opensc and gnutls-utils packages:

   # dnf -y install opensc gnutls-utils

2. Start the pcscd service.

   # systemctl start pcscd

Procedure

1. Erase your smart card and authenticate yourself with your PIN:

   $ pkcs15-init --erase-card --use-default-transport-keys
   Using reader with a card: Reader name
   PIN [Security Officer PIN] required.
   Please enter PIN [Security Officer PIN]:

   The card has been erased.

2. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:

   $ pkcs15-init --create-pkcs15 --use-default-transport-keys \
       --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123
   Using reader with a card: Reader name

   The pcks15-init tool creates a new slot on the smart card.

3. Set the label and the authentication ID for the slot:

   $ pkcs15-init --store-pin --label testuser \
       --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478
   Using reader with a card: Reader name

   The label is set to a human-readable value, in this case, testuser. The auth-id must be two hexadecimal values, in this case it is set to 01.

4. Store and label the private key in the new slot on the smart card:

   $ pkcs15-init --store-private-key testuser.key --label testuser_key \
       --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   The value you specify for --id must be the same when storing your private key, and certificate. If you do not specify a value for --id, a more complicated value is calculated by the tool and it is therefore easier to define your own value.

5. Store and label the certificate in the new slot on the smart card:

   $ pkcs15-init --store-certificate testuser.crt --label testuser_crt \
       --auth-id 01 --id 01 --format pem --pin 963214
   Using reader with a card: Reader name

6. (Optional) Store and label the public key in the new slot on the smart card:

   $ pkcs15-init --store-public-key testuserpublic.key
       --label testuserpublic_key --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   If the public key corresponds to a private key and/or certificate, you should specify the same ID as that private key and/or certificate.

7. (Optional) Some smart cards require you to finalize the card by locking the settings:

   $ pkcs15-init -F

   At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.

Procedure

1. Create a new directory for SSH keys in the home directory of the user who uses smart card authentication:

   # mkdir /home/example.user/.ssh

2. Run the ssh-keygen -D command with the opensc library to retrieve the existing public key paired with the private key on the smart card, and add it to the authorized_keys list of the user’s SSH keys directory to enable SSH access with smart card authentication.

   # ssh-keygen -D /usr/lib64/pkcs11/opensc-pkcs11.so >> ~example.user/.ssh/authorized_keys

3. SSH requires access right configuration for the /.ssh directory and the authorized_keys file. To set or change the access rights, enter:

   # chown -R example.user:example.user ~example.user/.ssh/
   # chmod 700 ~example.user/.ssh/
   # chmod 600 ~example.user/.ssh/authorized_keys

4. Optionally, display the keys:

   # cat ~example.user/.ssh/authorized_keys

   The terminal displays the keys.

5. Verify that the smart card authentication is enabled in the /etc/sssd/sssd.conf file:

   In the [pam] section, enable the pam certificate authentication module: pam_cert_auth = True

   If the sssd.conf file has not been created yet, you can create the minimal functional configuration by copying the following script to the command line:

   # cat > /etc/sssd/sssd.conf <<EOF
   [sssd]
   services = nss, pam
   domains = shadowutils
   
   [nss]
   
   [pam]
   pam_cert_auth = True
   
   [domain/shadowutils]
   id_provider = files
   EOF

6. To use the SSH keys, configure the authentication with the authselect command:

   # authselect select sssd with-smartcard with-smartcard-lock-on-removal --force