5.9. Smart Card Authentication

Procedure 5.19. Enabling Smart Cards

1. Ensure that the smart card hardware is plugged into the client machine and is installed according to manufacturer's directions.
2. Click the Virtual Machines tab and select a virtual machine.
3. Click Edit.
4. Click the Console tab and select the Smartcard Enabled check box.
5. Click OK.
6. Connect to the running virtual machine by clicking the Console icon. Smart card authentication is now passed from the client hardware to the virtual machine.

Procedure 5.20. Disabling Smart Cards

1. Click the Virtual Machines tab and select a virtual machine.
2. Click Edit.
3. Click the Console tab, and clear the Smartcard Enabled check box.
4. Click OK.

Procedure 5.21. Configuring Client Systems for Smart Card Sharing

1. Smart cards may require certain libraries in order to access their certificates. These libraries must be visible to the NSS library, which spice-gtk uses to provide the smart card to the guest. NSS expects the libraries to provide the PKCS #11 interface.
2. Make sure that the module architecture matches spice-gtk/remote-viewer's architecture. For instance, if you have only the 32b PKCS #11 library available, you must install the 32b build of virt-viewer in order for smart cards to work.

Procedure 5.22. Configuring RHEL clients with CoolKey Smart Card Middleware

• CoolKey Smart Card middleware is a part of Red Hat Enterprise Linux. Install the Smart card support group. If the Smart Card Support group is installed on a Red Hat Enterprise Linux system, smart cards are redirected to the guest when Smart Cards are enabled. The following command installs the Smart card support group:

  # yum groupinstall "Smart card support"

  Copy to Clipboard Toggle word wrap

Procedure 5.23. Configuring RHEL clients with Other Smart Card Middleware

• Register the library in the system's NSS database. Run the following command as root:

  # modutil -dbdir /etc/pki/nssdb -add "module name" -libfile /path/to/library.so

  Copy to Clipboard Toggle word wrap

Procedure 5.24. Configuring Windows Clients

• Red Hat does not provide PKCS #11 support to Windows clients. Libraries that provide PKCS #11 support must be obtained from third parties. When such libraries are obtained, register them by running the following command as a user with elevated privileges:

  modutil -dbdir %PROGRAMDATA%\pki\nssdb -add "module name" -libfile C:\Path\to\module.dll

  Copy to Clipboard Toggle word wrap