Novell ENHANCED SMART CARD METHOD 3.0.1 - INSTALLATION... Manual de usuario

Novell

www.novell.com

novdocx (en) 6 April 2007

Novell Enhanced Smart Card Method Installation Guide

Enhanced Smart Card Method

3.0.1

July 17, 2007

INSTALLATION GUIDE

novdocx (en) 6 April 2007

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities

on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export

laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.

See the Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information

on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on theNovell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 6 April 2007

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

novdocx (en) 6 April 2007

Contents 5

Contents

novdocx (en) 6 April 2007

About This Guide 7

1Overview 9

2 Novell Enhanced Smart Card Method Installation 11

2.1 Minimum Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.1.1 eDirectory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.1.2 Client Workstations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.2 Installing the Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2.2.1 eDirectory Server - Method Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

2.2.2 Client Workstation Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3 Configuring the Client 21

3.1 Disconnected Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.2 Identity Plug-In (ID-Plugin) Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.3 Custom Password Field Descriptor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.4 Smart Card Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

3.5 Novell Client Single Sign-On . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

3.6 Novell Client Passive Mode Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

4 Configuring the Server 25

4.1 Trusted Root Certificate Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.2 Certificate Revocation Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.2.1 OCSP Trusted Root Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

4.2.2 CRL Trusted Root Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

4.3 Certificate Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

4.4 Certificate Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

4.5 Certificate Expiration Warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

4.6 Card Removal Behavior. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

4.7 Check For Certificate Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

5 Basic Configuration Requirements 29

5.1 Activating the Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.2 Configuring Trusted Root Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.3 Configuring Certificate Revocation Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

5.4 Configuring Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

5.4.1 Subject Name Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

5.4.2 Certificate Matching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

5.4.3 Temporary Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

6 Troubleshooting 37

6.1 Method Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6.1.1 Enabling Server Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6Novell Enhanced Smart Card Method Installation Guide

novdocx (en) 6 April 2007

6.1.2 Enabling Client Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6.2 Workstation Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6.2.1 Smart Card Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6.2.2 Identity Plug-in Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6.2.3 Novell Client Single Sign-On Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6.3 Method Configuration Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6.3.1 Method Activation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6.3.2 Certificate Validation Issues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

7 Security Administrator’s Guide 41

7.1 Trusted Root Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

7.2 Certificate Validation/Revocation Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

7.3 Smart Card Enrollment eDirectory Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

7.4 Certificate Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

7.5 Restricting Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

7.6 Identity Plug-In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

7.7 Disconnected Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

8 Novell Audit Integration 43

A Silent Method Installation on Workstations 45

About This Guide

novdocx (en) 6 April 2007

About This Guide

This guide provides installation and configuration for the Novell Enhanced Smart Card Method. It is

written primarily for network administrators.

Chapter 1, “Overview,” on page 9

Chapter 2, “Novell Enhanced Smart Card Method Installation,” on page 11

Chapter 3, “Configuring the Client,” on page 21

Chapter 4, “Configuring the Server,” on page 25

Chapter 5, “Basic Configuration Requirements,” on page 29

Chapter 6, “Troubleshooting,” on page 37

Chapter 7, “Security Administrator’s Guide,” on page 41

Chapter 8, “Novell Audit Integration,” on page 43

Appendix A, “Silent Method Installation on Workstations,” on page 45

Documentation Conventions

In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux or UNIX, should use forward slashes as required by your software.

User Comments

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comment feature at the bottom of each page of the

online documentation, or go to www.novell.com/documentation/feedback.html and enter your

comments there.

Documentation Updates

For the most recent version of this documentation, see the Novell Enhanced Smart Card Method

Installation Guide (http://www.novell.com/documentation/ias/index.html?page=/documentation/

ias301/nescm_install/data/bookinfo.html).

8Novell Enhanced Smart Card Method Installation Guide

novdocx (en) 6 April 2007

Overview

novdocx (en) 6 April 2007

Overview

The Novell®Enhanced Smart Card Method (NESCM) is a Novell Modular Authentication Services

(NMASTM) method that provides smart-card-based authentication to eDirectoryTM. Smart card

authentication is a two-factor authentication technique: something you know (smart card PIN) and

something you have (smart card).

The login method consists of two components: the server module and the client module. The

appropriate modules are loaded during the authentication process by the NMAS server and client

components.

During authentication, the client module enumerates the certificates available on the attached smart

card and sends them to the server module. The server module chooses a certificate to use for

authentication based on the configuration and validation checks.

After selecting the login certificate, the server module generates a random challenge and sends it to

the client module to confirm that the user possesses the private key associated with the certificate.

The client module uses the smart card to sign the challenge and encrypt the result using RSA public/

private key encryption. Upon receiving the result, the server decrypts the data using the certificate's

public key and validates the challenge. If a valid certificate is not found or the challenge is not

validated, the login attempt fails.

The method supports disconnected or local Windows* workstation logins. Disconnected support

allows the smart card to be used for a local workstation login, when the eDirectory identity store

isn't available. This is useful in situations where network connectivity isn't always available, such as

for laptop users.

The method can also be configured to monitor the smart card reader device. Upon smart card

removal, the method can be configured to lock the workstation, log off the workstation, or take no

action.

10 Novell Enhanced Smart Card Method Installation Guide

novdocx (en) 6 April 2007

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Software de Novell

Novell

Novell EDIRECTORY 8.8 SP5 - TUNING GUIDE FOR UNIX... Guía de inicio rápido

Novell

Novell SUSE LINUX ENTERPRISE SERVER 10 STORAGE Manual de usuario

Novell

Novell GROUPWISE 8 - USERS Manual de usuario

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.2 -... Manual de instrucciones

Novell

Novell PLATESPIN PORTABILITY SUITE 8.1 Manual de usuario

Novell

Novell SENTINEL 6.1 SP1 HOTFIX 2 - READ ME 9-2009 Manual de usuario

Novell

Novell EVOLUTION 2.6 Manual de usuario

Novell

Novell ZENWORKS HANDELD MANAGEMENT 7 SP1 IR4 Manual de usuario

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Manual de servicio

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - STORAGE ADMINISTRATION GUIDE... Manual de instrucciones

Novell

Novell EDIRECTORY 8.8 - GUIDE Manual de usuario

Novell

Novell GROUPWISE 7 - INTEROPERABILITY GUIDE Manual de usuario

Novell

Novell GROUPWISE 8 - WEBACCESS Manual de usuario

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Manual de usuario

Novell

Novell ACCESS MANAGER 3.1 SP1 - ADMINISTRATION Manual de usuario

Novell

Novell IDENTITY MANAGER 3.6.1 - WORKORDER DRIVER IMPLEMENTATION GUIDE... Manual de usuario

Novell

Novell CLIENT FOR LINUX 2.0 SP3 Manual de instrucciones

Novell

Novell CLIENT FOR LINUX 2.0 SP3 - 11-2009 Manual de usuario

Novell

Novell GROUPWISE 8 - DATABASES Manual de usuario

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Manual de usuario

Novell

Novell OPEN WORKGROUP SUITE SMALL BUSINESS EDITION 2.0 - ... Manual de usuario

Novell

Novell iFOLDER 3.6 - READ ME 05-2008 Manual de usuario

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manual de programación

Novell

Novell ADMINSTUDIO 9.5 Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario

Lexmark

Lexmark Apps Manual de servicio