Chapter 7. Configuring smart card authentication using authselect

• Active Directory (AD)

• Identity Management (IdM)

  For details about how to create IdM certificates, see Requesting a new user certificate and exporting it to the client.

• Red Hat Certificate System (RHCS)

  For details, see Managing Smart Cards with the Enterprise Security Client.

• Third-party Certification Authority (CA)

• Local Certification Authority. You can use a certificate generated by the Local Certification Authority if the user is not part of a domain or for testing purposes.

  For details about how to create and import local certificates into a smart card, Configuring and importing local certificates to a smart card.

• with-smartcard — enables smart card authentication in addition to password authentication
• with-smartcard-required — enables smart card authentication and disables password authentication
• with-smartcard-lock-on-removal — enforces automatic screen lock when the smart card is removed

Prerequisites

• The smart card contains your certificate and private key.
• The card is inserted into the reader and connected to the computer.
• The authselect tool is installed on your system.

• with-smartcard: Users can authenticate with the user name and password or with their smart card.

• with-smartcard-required: Users can authenticate with their smart cards, and password authentication is disabled. You cannot access the system without your smart card. Once you have authenticated with your smart card, you can stay logged in even if your smart card is removed from its reader.

  Note

  The with-smartcard-required option only enforces exclusive smart card authentication for login services, such as login, gdm, xdm, xscreensaver, and gnome-screensaver. For other services, such as su or sudo for switching users, smart card authentication is not enforced and if your smart card is not inserted, you are prompted for a password.

• with-smartcard-lock-on-removal: Users can authenticate with their smart card. However, if you remove your smart card from its reader, you are automatically locked out of the system. You cannot use password authentication.

  Note

  The with-smartcard-lock-on-removal option only works on systems with the GNOME desktop environment. If you are using a system that is tty or console based and you remove your smart card from its reader, you are not automatically locked out of the system.