1.5. Smart card authentication options in RHEL
You can configure how you want smart card authentication to work in a particular Identity Management (IdM) client by using the authselect command, authselect enable-feature <smartcard_option>. The following smart card options are available:
-
with-smartcard: Users can authenticate with the user name and password or with their smart card. with-smartcard-required: Users can authenticate with their smart cards, and password authentication is disabled. You cannot access the system without your smart card. Once you have authenticated with your smart card, you can stay logged in even if your smart card is removed from its reader.注記The
with-smartcard-requiredoption only enforces exclusive smart card authentication for login services, such aslogin,gdm,xdm,xscreensaver, andgnome-screensaver. For other services, such assuorsudofor switching users, smart card authentication is not enforced and if your smart card is not inserted, you are prompted for a password.with-smartcard-lock-on-removal: Users can authenticate with their smart card. However, if you remove your smart card from its reader, you are automatically locked out of the system. You cannot use password authentication.注記The
with-smartcard-lock-on-removaloption only works on systems with the GNOME desktop environment. If you are using a system that isttyor console based and you remove your smart card from its reader, you are not automatically locked out of the system.