www.novell.com/documentation
Installation and Administration Guide
Enhanced Smart Card Method 3.0.8
April 02, 2012
Legal Notices
Novell,Inc.makesnorepresentationsorwarrantieswithrespecttothecontentsoruseofthisdocumentation,andspecifically
disclaimsanyexpressorimpliedwarrantiesofmerchantabilityorfitnessforanyparticularpurpose.Further,Novell,Inc.
reservestherighttorevisethispublicationandtomakechangestoitscontent,at
anytime,withoutobligationtonotifyany
personorentityofsuchrevisionsorchanges.
Further,Novell,Inc.makesnorepresentationsorwarrantieswithrespecttoanysoftware,andspecificallydisclaimsany
expressorimpliedwarrantiesofmerchantabilityorfitnessforanyparticularpurpose.Further,Novell,Inc.reservestheright
to
makechangestoanyandallpartsofNovellsoftware,atanytime,withoutanyobligationtonotifyanypersonorentityof
suchchanges.
AnyproductsortechnicalinformationprovidedunderthisAgreementmaybesubjecttoU.S.exportcontrolsandthetrade
lawsofothercountries.Youagreeto
complywithallexportcontrolregulationsandtoobtainanyrequiredlicensesor
classificationtoexport,re‐exportorimportdeliverables.Youagreenottoexportorre‐exporttoentitiesonthecurrentU.S.
exportexclusionlistsortoanyembargoedorterroristcountriesasspecifiedintheU.S.
exportlaws.Youagreetonotuse
deliverablesforprohibitednuclear,missile,orchemicalbiologicalweaponryenduses.SeetheNovellInternationalTrade
ServicesWebpage(http://www.novell.com/info/exports/)formoreinformationonexportingNovellsoftware.Novellassumes
noresponsibilityforyourfailuretoobtainanynecessaryexportapprovals.
Copyright©2012Novell,
Inc.Allrightsreserved.Nopartofthispublicationmaybereproduced,photocopied,storedona
retrievalsystem,ortransmittedwithouttheexpresswrittenconsentofthepublisher.
Novell, Inc.
1800 South Novell Place
Provo, UT 84606
U.S.A.
www.novell.com
OnlineDocumentation:ToaccessthelatestonlinedocumentationforthisandotherNovellproducts,seetheNovell
DocumentationWebpage(http://www.novell.com/documentation).
Novell Trademarks
ForNovelltrademarks,seetheNovellTrademarkandServiceMarklist(http://www.novell.com/company/legal/trademarks/
tmlist.html).
Third-Party Materials
Allthird‐partytrademarksarethepropertyoftheirrespectiveowners.
Contents 3
Contents
About This Guide 7
1 Overview 9
1.1 How NESCM Works. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
1.2 Additional Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2.1 Workstation Only Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
1.2.2 Card Removal Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
2 Novell Enhanced Smart Card Method Installation 11
2.1 Minimum Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
2.1.1 eDirectory Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
2.1.2 Client Workstations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
2.2 Installing the Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.2.1 eDirectory Server Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
2.2.2 Client Workstation Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
2.3 Uninstalling the Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
3 Configuring the Server 19
3.1 Configuring Trusted Root Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
3.2 Configuring Certificate Revocation Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.2.1 OCSP Trusted Root Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
3.2.2 CRL Trusted Root Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
3.2.3 Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.3 Configuring Certificate Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
3.3.1 Subject Name Matching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
3.3.2 Certificate Matching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
3.3.3 No Matching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28
3.3.4 Temporary Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
3.4 Certificate Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
3.5 Certificate Expiration Warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
3.6 Card Removal Behavior. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
3.7 Check for Certificate Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
3.8 Activating the Method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4 Troubleshooting 33
4.1 Method Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
4.1.1 Enabling Server Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.1.2 Enabling Client Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.2 Workstation Issues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.2.1 Smart Card Issues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.2.2 User Account Lookup (Identity Plug-In) Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
4.3 Method Configuration Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
4.3.1 Method Activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
4.3.2 Certificate Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4 Contents
5 Security Guidelines 37
5.1 Trusted Root Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37
5.2 Certificate Validation/Revocation Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
5.3 Smart Card Enrollment eDirectory Attributes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37
5.4 Certificate Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
5.5 Restricting Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
5.6 User Account Lookup (Identity Plug-In) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38
5.7 Workstation Only Login (Disconnected Login). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38
6 Using NESCM for Access Manager Authentication 39
7 Reporting Login Events 41
A Client Configuration Options 43
A.1 Smart Card Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
A.1.1 CSP with PC/SC Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43
A.1.2 PKCS#11 Library. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43
A.2 Smart Card PIN Validation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44
A.2.1 Turning Off PIN Validation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44
A.2.2 Hiding the Password Field When PIN Validation is Off . . . . . . . . . . . . . . . . . . . . . . . . . . . .44
A.3 Password Field Descriptor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
A.4 Workstation Only Login (Disconnected Support Login) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
A.4.1 Certificate Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
A.4.2 Local Account Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46
A.4.3 Fall-Back Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
A.4.4 Disconnected Workstation Unlock. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46
A.4.5 Workstation Only Login Exception. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47
A.5 User Account Lookup (Identity Plug-In Functionality) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
A.5.1 LDAP Search. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
A.5.2 Optimizing Search Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
A.6 Novell Client Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
A.6.1 Single Sign-On. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
A.6.2 Passive Mode Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49
B Silently Installing and Configuring the Method on Workstations 51
B.1 Installing the Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
B.1.1 Installing on a Machine without the Novell Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
B.1.2 Installing on a Machine with the Novell Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
B.1.3 Default Installation Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
B.2 Configuring the Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
B.2.1 Using the Registry to Configure NESCM After Installation (Recommended) . . . . . . . . . . .52
B.2.2 Using the Command Line to Configure NESCM During Installation . . . . . . . . . . . . . . . . . .52
C How the Authentication Works 57
D Registry Configuration Settings 59
E Documentation Updates 61
E.1 March 30, 2012 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61
E.2 March 18, 2010 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61
E.3 December 09, 2009 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62
6 Novell Enhanced Smart Card Method 3.0.8 Installation and Administration Guide
About This Guide 7
About This Guide
ThisguideprovidesinstallationandconfigurationinformationfortheNovellEnhancedSmartCard
Method.
Chapter 1,“Overview,”onpage 9
Chapter 2,“NovellEnhancedSmartCardMethodInstallation,”onpage 11
Chapter 3,“ConfiguringtheServer,”onpage 19
Chapter 4,“Troubleshooting,”onpage 33
Chapter 5,“SecurityGuidelines,”onpage 37
Chapter 6,“UsingNESCMforAccessManagerAuthentication,”onpage 39
Chapter 7,“ReportingLoginEvents,”onpage 41
Appendix A,“ClientConfigurationOptions,”onpage 43
Appendix B,“SilentlyInstallingandConfiguringtheMethodonWorkstations,”onpage 51
Appendix C,“HowtheAuthenticationWorks,”onpage 57
Appendix D,“RegistryConfigurationSettings,”onpage 59
Audience
Thisguideiswrittenprimarilyfornetworkadministrators.
Feedback
Wewanttohearyourcommentsandsuggestionsaboutthismanualandtheotherdocumentation
includedwiththisproduct.PleaseusetheUserCommentfeatureatthebottomofeachpageofthe
onlinedocumentationandenteryourcommentsthere.
Documentation Updates
Forthemostrecentversionofthisdocumentation,seetheNovellEnhancedSmartCardMethod
InstallationGuide(http://www.novell.com/documentation/ias/index.html?page=/documentation/
iasclient30x/nescm_install/data/bookinfo.html).
Documentation Conventions
InNovelldocumentation,agreater‐thansymbol(>)isusedtoseparateactionswithinastepand
itemsinacross‐referencepath.
Whenasinglepathnamecanbewrittenwithabackslashforsomeplatformsoraforwardslashfor
otherplatforms,thepathnameispresentedwithabackslash.Users
ofplatformsthatrequirea
forwardslash,suchasLinuxorUNIX,shoulduseforwardslashesasrequiredbyyoursoftware.
8 Novell Enhanced Smart Card Method 3.0.8 Installation and Administration Guide
1
Overview 9
1
Overview
TheNovellEnhancedSmartCardMethod(NESCM)isaNovellModularAuthenticationServices
(NMAS)methodthatprovidessmart‐card‐basedauthenticationtoeDirectory.Smartcard
authenticationisatwo‐factorauthenticationtechnique:somethingyouknow(smartcardPIN)and
somethingyouhave(smartcard).
Thefollowingsectionsprovideanoverviewto
NESCM:
Section 1.1,“HowNESCMWorks,”onpage 9
Section 1.2,“AdditionalFeatures,”onpage 9
1.1 How NESCM Works
Theloginmethodconsistsoftwocomponents:theservermoduleandtheclientmodule.The
appropriatemodulesareloadedduringtheauthenticationprocessbytheNMASserverandclient
components.
Duringauthentication,theclientmoduleenumeratesthecertificatesavailableontheattachedsmart
cardandsendsthemtotheservermodule.
Theservermodulechoosesacertificatetousefor
authentication,basedontheconfigurationandvalidationchecks.
Afterselectingthelogincertificate,theservermodulegeneratesarandomchallengeandsendsitto
theclientmoduletoconfirmthattheuserpossessestheprivatekeyassociatedwiththecertificate.
Theclient
moduleusesthesmartcardtosignthechallengeandencrypttheresultbyusingRSA
public/privatekeyencryption.Uponreceivingtheresult,theserverdecryptsthedatabyusingthe
certificateʹspublickeyandvalidatesthechallenge.Ifavalidcertificateisnotfoundorthechallengeis
not
validated,theloginattemptfails.Formoreinformationonhowthemethodworks,see
Appendix C,“HowtheAuthenticationWorks,”onpage 57.
1.2 Additional Features
Section 1.2.1,“WorkstationOnlyLogin,”onpage 9
Section 1.2.2,“CardRemovalSecurity,”onpage 10
1.2.1 Workstation Only Login
Inadditiontonetworkauthentication,themethodsupportslocal Windowsworkstationlogins.
WorkstationOnlyLoginallowsthesmartcardtobeusedforalocalworkstationloginwhenthe
eDirectoryidentitystoreisnʹtavailable.Thisisusefulinsituationswherenetworkconnectivityisnʹt
alwaysavailable,suchasforlaptop
users.
FormoreinformationonWorkstationOnlyLogin,seeSection A.4,“WorkstationOnlyLogin
(DisconnectedSupportLogin),”onpage 45.
10 Novell Enhanced Smart Card Method 3.0.8 Installation and Administration Guide
1.2.2 Card Removal Security
Themethodcanalsobeconfiguredtomonitorthesmartcardreaderdevice.Whenthesmartcardis
removed,themethodcanbeconfiguredtolocktheworkstationortologoff.Formoreinformation,
seeSection 3.6,“CardRemovalBehavior,”onpage 30.
2
Novell Enhanced Smart Card Method Installation 11
2
Novell Enhanced Smart Card Method
Installation
ThissectiondescribestheinstallationoftheNovellEnhancedSmartCardMethod(NESCM).
Section 2.1,“MinimumRequirements,”onpage 11
Section 2.2,“InstallingtheMethod,”onpage 13
Section 2.3,“UninstallingtheMethod,”onpage 17
2.1 Minimum Requirements
NESCMhasthefollowingminimumrequirements:
Section 2.1.1,“eDirectoryServer,”onpage 11
Section 2.1.2,“ClientWorkstations,”onpage 11
2.1.1 eDirectory Server
eDirectory8.8SP1orlaterononeofthefollowingplatforms:
NetWare6.5SP6orlater
WindowsServer2003SP1orlaterandWindows200832‐bit
SUSELinuxEnterpriseServer(SLES)1032‐bitor64‐bit
SUSELinuxEnterpriseServer(SLES)1132‐bitor64‐bit
RedHat
AS4.0Server32‐bitor64‐bit
RedHatEnterpriseLinux(RHEL)532‐bitor64‐bit
Solaris10onSunSPARC32‐bit
2.1.2 Client Workstations
NovellClient4.9.1SP5IR1orlaterinstalledonWindowsXPSP2orlater
NovellClient2SP2(IR2a)forWindowsVistaorlaterinstalledonWindowsVista(32‐bitand64‐
bit)
NovellClient2SP2(IR2a)forWindows7orlaterinstalledonWindows7(32‐bitand
64‐bit)
NovellClient2SP2(IR 2a)forWindowsServer2008(32‐bitand64‐bit)andWindowsServer2008
R2(64‐bit)
iManagerversion2.7SP3withNMASplug‐inversion3.200.20090408
12 Novell Enhanced Smart Card Method 3.0.8 Installation and Administration Guide
TheNESCMiManagerplug‐inhastheabilitytoquerycertificateinformationdirectlyfromsmart
cards.ThisfunctionalityissupportedonWindowswiththefollowingbrowsers:
InternetExplorer*6.0SP2orlater
MozillaFirefox*3.6.x/4.x.x/5.x.x /6.x.x/7.x.x/8.x.x
Firefox4.0andlateracceptsSSLcertificatessignedbyCAs
thatarenativelytrustedbyFirefox
forplug‐ininstallat ion.ToinstalltheNESCMplug‐inoveranSSLconnection,setthe
extensions.install.requireBuiltInCerts
to
false
intheFirefoxconfiguration.
LaunchFirefox,thentype
about:config
intheaddressbarofthebrowserwindow.
Ontheconfigurationpagethatdisplays,right‐clicktoopentheModifyMenu.
SelectNew>Boolean,thenspecifythenewpreferencenameas
extensions.install.requireBuiltInCerts
inthedialogboxandsetthisoptionto
false
.
InstalltheNESCMcardreaderplug‐inforFirefox.
Asmartcardreaderandappropriatesmartcardmiddlewaremustbeinstalledandproperly
configuredontheworkstation.ThemethodshouldworkwithmostWindowscompliantPC/SC
middleware.Ithasbeentestedwiththefollowing:
Table 2-1 Middleware,SmartCardReaders,andSmartCards
Device Tested Applications
Middleware
Netsign* CAC version 5.5.71.0
Gemplus* version 3.2.2 and 4.2
GemSAFE libraries 4.2
Gemalto PKCS11 For .NET V2+
GemCCID (PC USB PC/SC drivers)
ActivCard* Gold for CAC 3.0.1
ActivClient* 6.0 PKI Only or later
Cryptovision cv act sc/interface 3.2.1
eToken* Run Time Environment 3.60
CIP 4.07
FNMT Cryptographic Card Interface (Infineon,
ST, ST-WG10). RSA keys up to 2048
Novell Enhanced Smart Card Method Installation 13
2.2 Installing the Method
InstallationconsistsofinstallingthemethodontheeDirectoryserverandontheclientworkstations.
Section 2.2.1,“eDirectoryServerInstallation,”onpage 13
Section 2.2.2,“ClientWorkstationInstallation,”onpage 14
2.2.1 eDirectory Server Installation
1 LogintoiManagerasanAdministrator.
2 FromtheRolesandTasksview,clickNMAS>NMASLoginMethods.
3 ClickNew.
Themethodinstallationwizardislaunched.
4 Followthestepsinthemethodinstallationwizard:
4a Browsetoanddouble‐clickthe
EnhancedSmartCard_iMan27.zip
filethatcomeswiththe
method.Itislocatedontheclientdiskunderthe
NMAS Methods
folder.
ThiszipfilecontainstheservercomponentsandtheiManagercomponents.
4b Readandacceptthelicenseagreement.
Smart Card Readers
SCM Microsystems* SCR241 PCMCIA
SCM Microsystems SCR 131 Serial (RS232)
Cherry G83-6759LPAUS-2 USB Keyboard
Gemplus GemPC433-SL USB
Schlumberger Reflex 72v2
Schlumberger Reflex USB
SCM Microsystems SCR531-USB
Precise Biometrics 250 MC
ActivIdentity* USB Reader 2.0 and 3.0
ActivCard ActivCard USB Reader V3.0
C3P0 LTC3X USB Smart Card Reader v1.30
Smart Cards
Axalto Access 64K CAC
Gemplus GemXpresso* CAC
Gemalto .NET V2+
Oberthur CosmopolIC V4 CAC
Schlumberger Access 32K V2 CAC
Gemplus GemSAFE* SDK GPK16000
Cryptovision - CardOS M4.01a
Aladdin* - eToken PRO 64K
Oberthur CosmpolIC 64K V5.2 Fast ATR (PIV)
FNMT-RCM_ST_v2.0 (Ceres Card)
Device Tested Applications
14 Novell Enhanced Smart Card Method 3.0.8 Installation and Administration Guide
4c Reviewthemethodinformationand modifythevaluesasneeded.
Ifyoudon’tchangethename,thedefaultname(EnhancedSmartCard)isusedforthe
methodandloginsequencename.
4d ClickFinish.
5 Reviewtheinstallationsummarypage,thenclickClose.
6 RestartiManagertoensurethattheplug‐inisenabled.
7 ContinuewithChapter 3,“ConfiguringtheServer,”onpage 19tousetheplug‐intoconfigure
theNESCMinstallationontheserver.
2.2.2 Client Workstation Installation
Themethodmustbeinstalledoneachworkstation.Toinstallthe method,usetheNESCMsetup
program.
Themethodcanalsobeinstalledandconfiguredsilently.Formoreinformationonsilentinstallation,
seeAppendix B,“SilentlyInstallingandConfiguringtheMethodonWorkstations,”onpage 51.
1 LogintoaworkstationasanAdministrator.
2 Runthefollowingprogramfromthe
...\enhancedsmartcard\client
directory:
WindowsVista(32‐bit)/7(32‐bit)/XP/Server2008(32‐bit):
Setup.exe
WindowsVista(64‐bit)/7(64‐bit)/Server2008(64‐bit)/Server2008R2(64‐bit):
Setup_64.exe
ThislaunchestheNESCMsetupprogram.Followthestepsinthissetupprogramtoinstalland
configureNESCM.Forinformationconcerningspecificstepsinthesetupprogramforallclient
platforms(WindowsVista/7/XP/Server2008),seeTable2‐2onpage 14.
Forinformationconcerningspecificstepsinthesetupprogramfor
WindowsXPclient,seeTable
2‐3onpage 17.
Forextendedinformationontheoptions,seeAppendix A,“ClientConfigurationOptions,”on
page 43.
3 RepeatStep 1andStep 2foreveryworkstationwhereyouwanttoinstallthemethod.
Table2‐3explainstheconfigurationoptionsthatareavailablewhenyouusethesetupprogramto
installthemethodonaworkstation.
Table 2-2 SetupProgramOptionsforallClientPlatforms
Window Options
Smart Card Interface The method can communicate with the smart card by using a Windows
Cryptographic Service Provider (CSP) or PKCS#11 library. The recommended
communication method is CSP with PC/SC Interfaces. Use PKCS#11 interfaces only
if you know your smart card vendor does not provide a CSP.
CSP with PC/SC Interfaces: Select this option to use MS Crypto APIs and the
vendor’s CSP.
PKCS#11 Library: Select this and specify a PKCS#11 library to use PKCS#11
interfaces. If the library file is not present in the default system path, you must
provide the file path of the library file.
For more information on the smart card interface, see Section A.1, “Smart Card
Interface,” on page 43.
Novell Enhanced Smart Card Method Installation 15
Smart Card PIN The smart card PIN is always validated during login unless this option is turned off
(not selected). If this option is off, the PIN is not validated during login. It might be
desirable to turn off PIN validation if another application has established a smart card
session and previously validated the PIN. This prevents users from having to re-enter
the PIN.
Require Smart Card PIN Validation: Select this option to validate the PIN during
login.
For more information on smart card PIN validation, see Section A.2, “Smart Card PIN
Validation,” on page 44.
Workstation Only Login Normally, workstation only logins are password-based. The following options allow
the smart card to be used during a workstation only login:
Use Smart Card for Workstation Only Login: Select this option to use the
smart card for workstation only logins.
Require Smart Card for Workstation Only Login: Select this option to
disable password-based workstation only logins.
This option is only available if the Novell Client is installed.
For more information on Workstation Only Login, see Section A.4, “Workstation Only
Login (Disconnected Support Login),” on page 45.
User Account Lookup -
Identity Plug-in Support
The method can use eDirectory to look up the username that is associated with the
smart card. The method uses the certificate information on the smart card and
performs an LDAP search to locate the user account.
Automatically Look Up User Account: Select this option if you want the
method to automatically look up the user account.
This option is only available if the Novell Client is installed.
For more information on User Account Lookup, see Section A.5, “User Account
Lookup (Identity Plug-In Functionality),” on page 48.
(Conditional: LDAP
Search Options - Page
1) Identity Plug-in
Configuration
The following options specify how the LDAP search functionality of the Identity plug-
in functions:
LDAP Servers: In the Servers field, specify the server where you want the
search to take place. This is the LDAP server IP address or DNS name.
LDAP Search Base: In the Base field, specify the starting container to use
when searching for the user.
LDAP Search Timeout: In the Timeout field, specify the number of seconds
before the search does a timeout.
Window Options
16 Novell Enhanced Smart Card Method 3.0.8 Installation and Administration Guide
(Conditional: LDAP
Search Options - Page
2) Identity Plug-in
Configuration
The following options specify how the LDAP search functionality of the Identity Plug-
in functions:
Search By: Select how the search matches user accounts. If you select
Certificate Subject Name, it searches by the certificate’s subject name. If you
select Certificate, it searches using the complete certificate.
This setting should match the method’s Match By configuration setting.
Search Performance: Select Do Complete Search if you want the search
operation to wait to complete the search before returning. Select Use First
Account Returned if you want the search to quit after receiving the first result.
For large directories where searches can take a significant amount of time,
selecting Use First Account Returned can increase performance. However, if in
your environment one certificate is associated with multiple accounts, you
should select Do Complete Search to ensure that all possible matches are
presented to the user.
(Conditional: Progress
Message and Login
Options) Identity Plug-in
Configuration
The following options allow you to configure progress messages and login options for
the Identity Plug-in:
Status Message: In the Message field, specify the message that you want to
be displayed on the Novell Client Login dialog box while the user lookup is in
progress. Leave the field blank for no message.
The status message is displayed on the Novell Client Login dialog box while the
user lookup is in progress.
Wait Message: In the Message field, specify the message that you want to be
displayed in the Novell Client Login dialog box after user lookup is complete and
login has begun. Leave the field blank for no message.
The wait message is displayed in the Novell Client Login dialog box after the
user lookup is complete and login has begun.
Login Options: The following login options are available:
Automatically begin login when user lookup returns: Select this
option to automatically start the login process after the account lookup
finishes. If you select this option, the user does not need to click the OK
button to begin the login process.
Restart user lookup if login fails: Select this option to automatically
restart the Identity Plug-in if the login fails.
Selecting both Automatically begin login when user lookup returns and Restart
user lookup if login fails is not recommended. Using these two options
simultaneously can lead to continuous looping failed login attempts.
Window Options
Novell Enhanced Smart Card Method Installation 17
Table 2-3 SetupProgramOptionsforWindowsXPClient
2.3 Uninstalling the Method
YoucanuninstallNESCMusingtheAddorRemoveProgramsoptioninControlPanel.
IfyouhaveanyoftheNESCMapplicationsrunningonWindowsVistaandWindow7,adialogbox
appears,asshowninFigure2‐1,indicatingyoutoclosetheapplications.YoumustselecttheDo
not
closeapplicationsoptiontocontinuewiththeuninstallation.
(Conditional: Novell
Client Login Dialog
Options) Identity Plug-in
Configuration
Selecting the following options allows you to hide user interface controls in the Novell
Client login dialog:
Hide OK Button: Select this option only when Automatically begin login when
user lookup returns is selected. See “(Conditional: Progress Message and
Login Options) Identity Plug-in Configuration” on page 16 for more information.
Hide Cancel Button: Select this option if you don’t want users to see the
Cancel button.
Hide Advanced Button: Select this option if you don’t want users to see the
additional login dialog box settings.
Hide Username Field: You might want to select this option when using the
user account lookup functionality, because users usually do not interact with the
username field. Hiding this field might be considered useful in some
circumstances. See “User Account Lookup - Identity Plug-in Support” on
page 15 for more information.
Hide Password Field: You might want to select this option when Automatically
begin login when user lookup returns is selected. After the lookup returns, the
login begins and the method prompts the user for a PIN unless PIN validation is
turned off. See “Smart Card PIN” on page 15 for more information.
Window Options
Password Field Descriptor The Novell Client login dialog box labels the Password field with the word
“Password.” When using NESCM, enter the smart card PIN in the Password
field. This option allows you to change the label to a more intuitive
description, like “PIN.”
Use Custom Descriptor: Select this option and enter a new label to
change the descriptor.
This option is only available if the Novell Client is installed.
For more information on the Password Field Descriptor, see Section A.3,
“Password Field Descriptor,” on page 45.
Window Options
18 Novell Enhanced Smart Card Method 3.0.8 Installation and Administration Guide
Figure 2-1 UninstallationDialogBox
3
Configuring the Server 19
3
Configuring the Server
AfterinstallingtheNovellEnhancedSmartCardMethod(NESCM),youneedtoconfiguretheserver.
Todothis,usetheNovelliManagerSmartCardLoginplug‐in.Iftheplug‐inisnotalreadyinstalled,
seeSection 2.2.1,“eDirectoryServerInstallation,”onpage 13.Administratorsusethisplug‐into
configuresettings
forthewholetree,partitions,containers,orindividualusers.
Theplug‐inhasthefollowingsettings:
Global:Theglobalsettingsareusedtospecifypoliciesforthewholetree.Optionsconfigured
globallyapplytoalluserobjectsinthetree.
Container:Ifthecontainerobjectisapartitionroot,thesettings
areeffectiveforalluserobjects
inthepartition.Ifthecontainerisnotapartitionroot,thesettingsareeffectiveonlyforobjectsin
theimmediatecontainer.Thesettingsdonotaffectusersinsubcontainersbelowthecontainer.
User:UsersettingsapplytotheindividualUserobject.
Eachsettingis
describedbelowandidentifiedasaglobal,container,oruserlevelsetting.In
iManager,intheRolesandTasksview,clickSmartCardLogintodisplaythesesettings.Manysettings
canbeconfiguredonalllevels.Settingsconfiguredatlowerlevelsinthedirectoryhierarchyoverride
higher‐levelconfigurations.
Section 3.1,
“ConfiguringTrustedRootCertificates,”onpage 19
Section 3.2,“ConfiguringCertificateRevocationChecking,”onpage 22
Section 3.3,“ConfiguringCertificateMatching,”onpage 24
Section 3.4,“CertificateValidation,”onpage 30
Section 3.5,“CertificateExpirationWarning,”onpage 30
Section 3.6,“CardRemovalBehavior,”onpage 30
Section 3.7,“CheckforCertificatePolicy,”onpage 30
Section 3.8,“ActivatingtheMethod,”onpage 30
3.1 Configuring Trusted Root Certificates
ConfigurationLevel:Global
Thelistoftrustedrootcontainersisusedforcertificatevalidation.Duringcertificatevalidation,the
methodbuildsthecertificatechain.Inordertobevalid,thecertificatechainmustendwithatrusted
rootcertificate.TrustedrootcertificatesarestoredintrustedrootcontainersineDirectory.
20 Novell Enhanced Smart Card Method 3.0.8 Installation and Administration Guide
Thecertificatevalidationprocessensuresthatthelogincertificatehasbeenissuedbyatrusted
CertificateAuthority(CA).Thisisaccomplishedbyvalidatingthatthecertificatechaincontainsonly
trustedrootcertificates.
1 IniManager,createatrustedrootcontainer:
1a SelectNovellCertificateServer>CreateTrustedRootContainer.
1b Specifythecontainernameandlocation.
1c ClickOK.
2 Importtrustedrootcertificates:
2a SelectNovellCertificateServer>CreateTrustedRoot.
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
/
