Chapter 9. Configuring certificates issued by ADCS for smart card authentication in IdM To configure smart card authentication in IdM for users whose certificates are issued by Active Directory (AD) certificate services: Your deployment is based on cross-forest trust between Identity Management (IdM) and Active Directory (AD). You want to allow smart card authentication for users whose accounts are stored in AD. Certificates are created and stored in Active Directory Certificate Services (ADCS). For an overview of smart card authentication, see Understanding smart card authentication . Configuration is accomplished in the following steps: Copying CA and user certificates from Active Directory to the IdM server and client Configuring the IdM server and clients for smart card authentication using ADCS certificates Converting a PFX (PKCS#12) file to be able to store the certificate and private key into the smart card Configuring timeouts in the sssd.conf file Creating certificate mapping rules for smart card authentication Prerequisites Identity Management (IdM) and Active Directory (AD) trust is installed For details, see Installing trust between IdM and AD . Active Directory Certificate Services (ADCS) is installed and certificates for users are generated 9.1. Windows Server settings required for trust configuration and certificate usage You must configure the following on the Windows Server: Active Directory Certificate Services (ADCS) is installed Certificate Authority is created Optional: If you are using Certificate Authority Web Enrollment, the Internet Information Services (IIS) must be configured Export the certificate: Key must have 2048 bits or more Include a private key You will need a certificate in the following format: Personal Information Exchange - PKCS #12(.PFX) Enable certificate privacy 9.2. Copying certificates from Active Directory using sftp To be able to use smart card authetication, you need to copy the following certificate files: A root CA certificate in the CER format: adcs-winserver-ca.cer on your IdM server. A user certificate with a private key in the PFX format: aduser1.pfx on an IdM client. Note This procedure expects SSH access is allowed. If SSH is unavailable the user must copy the file from the AD Server to the IdM server and client. Procedure Connect from the IdM server and copy the adcs-winserver-ca.cer root certificate to the IdM server: Connect from the IdM client and copy the aduser1.pfx user certificate to the client: Now the CA certificate is stored in the IdM server and the user certificates is stored on the client machine. 9.3. Configuring the IdM server and clients for smart card authentication using ADCS certificates You must configure the IdM (Identity Management) server and clients to be able to use smart card authentication in the IdM environment. IdM includes the ipa-advise scripts which makes all necessary changes: Install necessary packages Configure IdM server and clients Copy the CA certificates into the expected locations You can run ipa-advise on your IdM server. Follow this procedure to configure your server and clients for smart card authentication: On an IdM server: Preparing the ipa-advise script to configure your IdM server for smart card authentication. On an IdM server: Preparing the ipa-advise script to configure your IdM client for smart card authentication. On an IdM server: Applying the the ipa-advise server script on the IdM server using the AD certificate. Moving the client script to the IdM client machine. On an IdM client: Applying the the ipa-advise client script on the IdM client using the AD certificate. Prerequisites The certificate has been copied to the IdM server. Obtain the Kerberos ticket. Log in as a user with administration rights. Procedure On the IdM server, use the ipa-advise script for configuring a client: On the IdM server, use the ipa-advise script for configuring a server: On the IdM server, execute the script: It configures the IdM Apache HTTP Server. It enables Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) on the Key Distribution Center (KDC). It configures the IdM Web UI to accept smart card authorization requests. Copy the sc_client.sh script to the client system: Copy the Windows certificate to the client system: On the client system, run the client script: The CA certificate is installed in the correct format on the IdM server and client systems and step is to copy the user certificates onto the smart card itself. 9.4. Converting the PFX file Before you store the PFX (PKCS#12) file into the smart card, you must: Convert the file to the PEM format Extract the private key and the certificate to two different files Prerequisites The PFX file is copied into the IdM client machine. Procedure On the IdM client, into the PEM format: Extract the key into the separate file: Extract the public certificate into the separate file: At this point, you can store the aduser1.key and aduser1.crt into the smart card. 9.5. Installing tools for managing and using smart cards Prerequisites The gnutls-utils package is installed. The opensc package is installed. The pcscd service is running. Before you can configure your smart card, you must install the corresponding tools, which can generate certificates and start the pscd service. Procedure Install the opensc and gnutls-utils packages: Start the pcscd service. Verification Verify that the pcscd service is up and running 9.6. Preparing your smart card and uploading your certificates and keys to your smart card Follow this procedure to configure your smart card with the pkcs15-init tool, which helps you to configure: Erasing your smart card Setting new PINs and optional PIN Unblocking Keys (PUKs) Creating a new slot on the smart card Storing the certificate, private key, and public key in the slot If required, locking the smart card settings as certain smart cards require this type of finalization Note The pkcs15-init tool may not work with all smart cards. You must use the tools that work with the smart card you are using. Prerequisites The opensc package, which includes the pkcs15-init tool, is installed. For more details, see Installing tools for managing and using smart cards . The card is inserted in the reader and connected to the computer. You have a private key, a public key, and a certificate to store on the smart card. In this procedure, testuser.key , testuserpublic.key , and testuser.crt are the names used for the private key, public key, and the certificate. You have your current smart card user PIN and Security Officer PIN (SO-PIN). Procedure Erase your smart card and authenticate yourself with your PIN: The card has been erased. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK: The pcks15-init tool creates a new slot on the smart card. Set a label and the authentication ID for the slot: The label is set to a human-readable value, in this case, testuser . The auth-id must be two hexadecimal values, in this case it is set to 01 . Store and label the private key in the new slot on the smart card: Note The value you specify for --id must be the same when storing your private key and storing your certificate in the step. Specifying your own value for --id is recommended as otherwise a more complicated value is calculated by the tool. Store and label the certificate in the new slot on the smart card: Optional: Store and label the public key in the new slot on the smart card: Note If the public key corresponds to a private key or certificate, specify the same ID as the ID of the private key or certificate. Optional: Certain smart cards require you to finalize the card by locking the settings: At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK. 9.7. Configuring timeouts in sssd.conf Authentication with a smart card certificate might take longer than the default timeouts used by SSSD. Time out expiration can be caused by: Slow reader A forwarding form a physical device into a virtual environment Too many certificates stored on the smart card Slow response from the OCSP (Online Certificate Status Protocol) responder if OCSP is used to verify the certificates In this case you can prolong the following timeouts in the sssd.conf file, for example, to 60 seconds: p11_child_timeout krb5_auth_timeout Prerequisites You must be logged in as root. Procedure Open the sssd.conf file: Change the value of p11_child_timeout : Change the value of krb5_auth_timeout : Save the settings. Now, the interaction with the smart card is allowed to run for 1 minute (60 seconds) before authentication will fail with a timeout. 9.8. Creating certificate mapping rules for smart card authentication If you want to use one certificate for a user who has accounts in AD (Active Directory) and in IdM (Identity Management), you can create a certificate mapping rule on the IdM server. After creating such a rule, the user is able to authenticate with their smart card in both domains. For details about certificate mapping rules, see Certificate mapping rules for configuring authentication .

Commands:
root@idmserver ~]# sftp Administrator@winserver.ad.example.com Administrator@winserver.ad.example.com's password: Connected to Administrator@winserver.ad.example.com. sftp> cd <Path to certificates> sftp> ls adcs-winserver-ca.cer aduser1.pfx sftp> sftp> get adcs-winserver-ca.cer Fetching <Path to certificates>/adcs-winserver-ca.cer to adcs-winserver-ca.cer <Path to certificates>/adcs-winserver-ca.cer 100% 1254 15KB/s 00:00 sftp quit
sftp Administrator@winserver.ad.example.com Administrator@winserver.ad.example.com's password: Connected to Administrator@winserver.ad.example.com. sftp> cd /<Path to certificates> sftp> get aduser1.pfx Fetching <Path to certificates>/aduser1.pfx to aduser1.pfx <Path to certificates>/aduser1.pfx 100% 1254 15KB/s 00:00 sftp quit
ipa-advise config-client-for-smart-card-auth > sc_client.sh
ipa-advise config-server-for-smart-card-auth > sc_server.sh
sh -x sc_server.sh adcs-winserver-ca.cer
scp sc_client.sh root@client1.idm.example.com:/root Password: sc_client.sh 100% 2857 1.6MB/s 00:00
scp adcs-winserver-ca.cer root@client1.idm.example.com:/root Password: adcs-winserver-ca.cer 100% 1254 952.0KB/s 00:00
sh -x sc_client.sh adcs-winserver-ca.cer
openssl pkcs12 -in aduser1.pfx -out aduser1_cert_only.pem -clcerts -nodes Enter Import Password:
openssl pkcs12 -in adduser1.pfx -nocerts -out adduser1.pem > aduser1.key
openssl pkcs12 -in adduser1.pfx -clcerts -nokeys -out aduser1_cert_only.pem > aduser1.crt
dnf -y install opensc gnutls-utils
systemctl start pcscd
systemctl status pcscd
pkcs15-init --erase-card --use-default-transport-keys Using reader with a card: Reader name PIN [Security Officer PIN] required. Please enter PIN [Security Officer PIN]:
pkcs15-init --create-pkcs15 --use-default-transport-keys --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123 Using reader with a card: Reader name
pkcs15-init --store-pin --label testuser --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478 Using reader with a card: Reader name
pkcs15-init --store-private-key testuser.key --label testuser_key --auth-id 01 --id 01 --pin 963214 Using reader with a card: Reader name
pkcs15-init --store-certificate testuser.crt --label testuser_crt --auth-id 01 --id 01 --format pem --pin 963214 Using reader with a card: Reader name
pkcs15-init --store-public-key testuserpublic.key --label testuserpublic_key --auth-id 01 --id 01 --pin 963214 Using reader with a card: Reader name
pkcs15-init -F
vim /etc/sssd/sssd.conf
[pam] p11_child_timeout = 60
[domain/IDM.EXAMPLE.COM] krb5_auth_timeout = 60