Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

23.3. Authenticating to an Identity Management Client with a Smart Card

As an Identity Management user with multiple role accounts in the Identity Management server, you can authenticate with your smart card to a desktop client system joined to the Identity Management domain. This enables you to use the client system as the selected role.
For a basic overview of the supported options, see:
For information on configuring the environment to enable the authentication, see:
For information on how to authenticate, see:
Users in Identity Management can use the following options when authenticating using a smart card on Identity Management clients.
Local authentication
Local authentication includes authentication using:
  • the text console
  • the graphical console, such as the Gnome Display Manager (GDM)
  • local authentication services, such as su or sudo
Remote authentication with ssh
Certificates on a smart card are stored together with the PIN-protected SSH private key.
Smart card-based authentication using other services, such as FTP, is not supported.
As the Identity Management administrator, perform these steps:
  1. On the server, create a shell script to configure the client.
    1. Use the ipa-advise config-client-for-smart-card-auth command, and save its output to a file: 
      # ipa-advise config-client-for-smart-card-auth > client_smart_card_script.sh
      Copy to Clipboard Toggle word wrap
    2. Open the script file, and review its contents.
    3. Add execute permissions to the file using the chmod utility: 
      # chmod +x client_smart_card_script.sh
      Copy to Clipboard Toggle word wrap
  2. Copy the script to the client, and run it. Add the path to the PEM file with the certificate authority (CA) that signed the smart card certificate: 
    # ./client_smart_card_script.sh CA_cert.pem
    Copy to Clipboard Toggle word wrap
Additionally, if an external certificate authority (CA) signed the certificate on the smart card, add the smart card CA as a trusted CA:
  1. On the Identity Management server, install the CA certificate: 
    # ipa-cacert-manage -n "SmartCard CA" -t CT,C,C install ca.pem
# ipa-certupdate
    Copy to Clipboard Toggle word wrap
    Repeat ipa-certupdate also on all replicas and clients.
  2. Restart the HTTP server: 
    # systemctl restart httpd
    Copy to Clipboard Toggle word wrap
    Repeat systemctl restart httpd also on all replicas.
Note
SSSD enables administrators to tune the certificate verification process with the certificate_verification parameter, for example if the Online Certificate Status Protocol (OCSP) servers defined in the certificate are not reachable from the client. For more information, see the sssd.conf(5) man page.
To authenticate as an Identity Management user, enter the user name and PIN.
  • When logging in from the command line: 
    client login: idm_user
PIN for PIV Card Holder pin (PIV_II) for user idm_user@idm.example.com:
    Copy to Clipboard Toggle word wrap
  • When logging in using the Gnome Desktop Manager (GDM), GDM prompts you for the smart card PIN after you select the required user:

    Figure 23.13. Entering the smart card PIN in the Gnome Desktop Manager

    Entering the smart card PIN in the Gnome Desktop Manager
    View larger image
    Entering the smart card PIN in the Gnome Desktop Manager
To authenticate as an Active Directory user, enter the user name in a format that uses the NetBIOS domain name: AD.EXAMPLE.COM\ad_user or ad_user@AD.EXAMPLE.COM.
If the authentication fails, see Section A.4, “Investigating Smart Card Authentication Failures”.
On the local system, perform these steps:
  1. Insert the smart card.
  2. Launch ssh, and specify the PKCS#11 library with the -I option:
    • As an Identity Management user: 
      $ ssh -I /usr/lib64/opensc-pkcs11.so -l idm_user server.idm.example.com

Enter PIN for 'PIV_II (PIV Card Holder pin)':
Last login: Thu Apr  6 12:49:32 2017 from 10.36.116.42
      Copy to Clipboard Toggle word wrap
    • As an Active Directory user: 
      $ ssh -I /usr/lib64/opensc-pkcs11.so -l ad_user@ad.example.com server.idm.example.com

Enter PIN for 'PIV_II (PIV Card Holder pin)':
Last login: Thu Apr  6 12:49:32 2017 from 10.36.116.42
      Copy to Clipboard Toggle word wrap
  3. Optional. Use the id utility to check that you are logged in as the intended user.
    • As an Identity Management user: 
      $ id
uid=1928200001(idm_user) gid=1928200001(idm_user) groups=1928200001(idm_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
      Copy to Clipboard Toggle word wrap
    • As an Active Directory user: 
      $ id
uid=1171201116(ad_user@ad.example.com) gid=1171201116(ad_user@ad.example.com) groups=1171201116(ad_user@ad.example.com),1171200513(domain users@ad.example.com) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
      Copy to Clipboard Toggle word wrap
If the authentication fails, see Section A.4, “Investigating Smart Card Authentication Failures”.

23.3.5. Additional Resources
Copy link

  • Authentication using ssh with a smart card does not obtain a ticket-granting ticket (TGT) on the remote system. To obtain a TGT on the remote system, the administrator must configure Kerberos on the local system and enable Kerberos delegation. For an example of the required configuration, see this Kerberos knowledge base entry.
  • For details on smart-card authentication with OpenSSH, see Using Smart Cards to Supply Credentials to OpenSSH in the Security Guide.
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat