9.4. Configuring the IdM server and clients for smart card authentication using ADCS certificates

Procedure

1. On the IdM server, use the ipa-advise script for configuring a client:

   [root@idmserver ~]# ipa-advise config-client-for-smart-card-auth > sc_client.sh

2. On the IdM server, use the ipa-advise script for configuring a server:

   [root@idmserver ~]# ipa-advise config-server-for-smart-card-auth > sc_server.sh

3. On the IdM server, execute the script:

   [root@idmserver ~]# sh -x sc_server.sh adcs-winserver-ca.cer

   • It configures the IdM Apache HTTP Server.
   • It enables Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) on the Key Distribution Center (KDC).
   • It configures the IdM Web UI to accept smart card authorization requests.

4. Copy the sc_client.sh script to the client system:

   [root@idmserver ~]# scp sc_client.sh root@client1.idm.example.com:/root
   Password:
   sc_client.sh                  100%  2857   1.6MB/s   00:00

5. Copy the Windows certificate to the client system:

   [root@idmserver ~]# scp adcs-winserver-ca.cer root@client1.idm.example.com:/root
   Password:
   adcs-winserver-ca.cer                 100%  1254   952.0KB/s   00:00

6. On the client system, run the client script:

   [root@idmclient1 ~]# sh -x sc_client.sh adcs-winserver-ca.cer

   The CA certificate is now installed in the correct format on the IdM server and client systems. The next step is to copy the user certificates onto the smart card itself.