missionmdf.blogg.se - Mac piv card reader

You can check an account on a mac with the “sc_auth” command. Your Active Directory service must contain the hash of the smart card in the “AuthenticationAuthority” field. Don’t forget to set your security preference to require a password on screensaver immediately! Then it should auto populate the username field and change from password to PIN. Again it will ask for a username and password until you insert the card. The next test is to activate the screensaver. Insert your smart card, the password should change to PIN. Now with any luck (and good fortune with drivers) (and smart card reader firmware), when you go back to the loginwindow it will ask for a password for a select user account. The plist to capture is the user preference “”. Tim Sutton’s mcxtoprofile is handy for this.

Deploy a profile that enables the screen saver when the token is removed.

Install the TokenD driver for your brand of smart card.

Install the CCID driver for your smart card reader.

A configuration profile works best for this.

Deploy your internal certificate authority cert to the System keychain.

sudo security authorizationdb smartcard enable.

Enable smart card authentication through the authorization database.

So as part of your deployment process, this is what needs to happen. I’ll explain about local accounts later on. This assumes you have a properly set up AD environment with the card hash already tied to the correct user account.

This is the driver that allows the computer to talk to the chip on the card. Taken straight from the open source “SmartCard Services” page, a TokenD is the low-level module(s) which interface to each specific Smart Card’s applet or file OS. Obviously this is done over USB, but there are increasing Bluetooth based readers on the market.Įffectively this can be simplified down to the driver for the smart card reader. The CCID (chip card interface device) is a USB protocol that allows a smart card to be connected to a computer via a card reader. Let’s start however with a couple new terms: CCID In these OS versions, the CDSA framework is present. The basic part we learned is that this is a very complex subject to tackle! The best way to go forward is to see a couple examples of how things can be set up. We learned about the various types of smart cards and how they interact with various operating systems.