Novell ENHANCED SMART CARD METHOD 3.0.1 - INSTALLATION... User manual

Novell
www.novell.com
novdocx (en) 6 April 2007
Novell Enhanced Smart Card Method Installation Guide
Enhanced Smart Card Method
3.0.1
July 17, 2007
INSTALLATION GUIDE

novdocx (en) 6 April 2007
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities
on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export
laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.
See the Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information
on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export
approvals.
Copyright © 2007 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on theNovell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 6 April 2007
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

novdocx (en) 6 April 2007

Contents 5
Contents
novdocx (en) 6 April 2007
About This Guide 7
1Overview 9
2 Novell Enhanced Smart Card Method Installation 11
2.1 Minimum Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.1.1 eDirectory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.1.2 Client Workstations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2 Installing the Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2.1 eDirectory Server - Method Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2.2 Client Workstation Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3 Configuring the Client 21
3.1 Disconnected Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.2 Identity Plug-In (ID-Plugin) Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.3 Custom Password Field Descriptor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.4 Smart Card Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.5 Novell Client Single Sign-On . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.6 Novell Client Passive Mode Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4 Configuring the Server 25
4.1 Trusted Root Certificate Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
4.2 Certificate Revocation Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
4.2.1 OCSP Trusted Root Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4.2.2 CRL Trusted Root Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4.3 Certificate Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4.4 Certificate Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4.5 Certificate Expiration Warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
4.6 Card Removal Behavior. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
4.7 Check For Certificate Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
5 Basic Configuration Requirements 29
5.1 Activating the Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
5.2 Configuring Trusted Root Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
5.3 Configuring Certificate Revocation Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.4 Configuring Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.4.1 Subject Name Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.4.2 Certificate Matching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
5.4.3 Temporary Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
6 Troubleshooting 37
6.1 Method Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.1.1 Enabling Server Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6Novell Enhanced Smart Card Method Installation Guide
novdocx (en) 6 April 2007
6.1.2 Enabling Client Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.2 Workstation Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.2.1 Smart Card Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
6.2.2 Identity Plug-in Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
6.2.3 Novell Client Single Sign-On Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
6.3 Method Configuration Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
6.3.1 Method Activation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
6.3.2 Certificate Validation Issues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
7 Security Administrator’s Guide 41
7.1 Trusted Root Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.2 Certificate Validation/Revocation Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.3 Smart Card Enrollment eDirectory Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.4 Certificate Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.5 Restricting Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.6 Identity Plug-In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
7.7 Disconnected Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
8 Novell Audit Integration 43
A Silent Method Installation on Workstations 45

About This Guide
novdocx (en) 6 April 2007
7
About This Guide
This guide provides installation and configuration for the Novell Enhanced Smart Card Method. It is
written primarily for network administrators.
Chapter 1, “Overview,” on page 9
Chapter 2, “Novell Enhanced Smart Card Method Installation,” on page 11
Chapter 3, “Configuring the Client,” on page 21
Chapter 4, “Configuring the Server,” on page 25
Chapter 5, “Basic Configuration Requirements,” on page 29
Chapter 6, “Troubleshooting,” on page 37
Chapter 7, “Security Administrator’s Guide,” on page 41
Chapter 8, “Novell Audit Integration,” on page 43
Appendix A, “Silent Method Installation on Workstations,” on page 45
Documentation Conventions
In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux or UNIX, should use forward slashes as required by your software.
User Comments
We want to hear your comments and suggestions about this manual and the other documentation
included with this product. Please use the User Comment feature at the bottom of each page of the
online documentation, or go to www.novell.com/documentation/feedback.html and enter your
comments there.
Documentation Updates
For the most recent version of this documentation, see the Novell Enhanced Smart Card Method
Installation Guide (http://www.novell.com/documentation/ias/index.html?page=/documentation/
ias301/nescm_install/data/bookinfo.html).

8Novell Enhanced Smart Card Method Installation Guide
novdocx (en) 6 April 2007

Overview
1
novdocx (en) 6 April 2007
9
1
Overview
The Novell®Enhanced Smart Card Method (NESCM) is a Novell Modular Authentication Services
(NMASTM) method that provides smart-card-based authentication to eDirectoryTM. Smart card
authentication is a two-factor authentication technique: something you know (smart card PIN) and
something you have (smart card).
The login method consists of two components: the server module and the client module. The
appropriate modules are loaded during the authentication process by the NMAS server and client
components.
During authentication, the client module enumerates the certificates available on the attached smart
card and sends them to the server module. The server module chooses a certificate to use for
authentication based on the configuration and validation checks.
After selecting the login certificate, the server module generates a random challenge and sends it to
the client module to confirm that the user possesses the private key associated with the certificate.
The client module uses the smart card to sign the challenge and encrypt the result using RSA public/
private key encryption. Upon receiving the result, the server decrypts the data using the certificate's
public key and validates the challenge. If a valid certificate is not found or the challenge is not
validated, the login attempt fails.
The method supports disconnected or local Windows* workstation logins. Disconnected support
allows the smart card to be used for a local workstation login, when the eDirectory identity store
isn't available. This is useful in situations where network connectivity isn't always available, such as
for laptop users.
The method can also be configured to monitor the smart card reader device. Upon smart card
removal, the method can be configured to lock the workstation, log off the workstation, or take no
action.

10 Novell Enhanced Smart Card Method Installation Guide
novdocx (en) 6 April 2007

Novell Enhanced Smart Card Method Installation
2
novdocx (en) 6 April 2007
11
2
Novell Enhanced Smart Card
Method Installation
This section describes the installation of the Novell®Enhanced Smart Card Method (NESCM).
Section 2.1, “Minimum Requirements,” on page 11
Section 2.2, “Installing the Method,” on page 12
2.1 Minimum Requirements
NESCM has the following minimum requirements:
Section 2.1.1, “eDirectory Server,” on page 11
Section 2.1.2, “Client Workstations,” on page 11
2.1.1 eDirectory Server
eDirectoryTM 8.7.3 IR9 or eDirectory 8.8 SP1 on one of the following platforms:
NetWare®6.5 SP6 or later
Windows 2003 Server SP1 or later
Linux* SUSE®Linux Enterprise Server (SLES) 10 32-bit or 64-bit
Red Hat* AS 4.0 Server 32-bit or 64-bit
2.1.2 Client Workstations
Novell ClientTM 4.91 SP3 installed on Windows XP SP2
A smart card reader and appropriate smart card middleware must be installed and properly
configured on the workstation. The method should work with any Windows XP compliant PC/SC
middleware. It has been tested with the following:
Middleware:
Netsign* CAC version 5.5.71.0
Gemplus* version 3.2.2 and 4.2
ActivCard* Gold for CAC 3.01
ActivClient* 6.0 PKI Only
CryptoVision* cv act sc/interface 3.2.1
eToken* Run Time Environment 3.60
DataKey* CIP 4.07

12 Novell Enhanced Smart Card Method Installation Guide
novdocx (en) 6 April 2007
Smart Card Readers
SCM Microsystems* - SCR241 - PCMCIA
SCM Microsystems - SCR131 - Serial (RS232)
Cherry - G83-6759LPAUS-2 - USB Keyboard
Gemplus - GemPC433-SL - USB
Schlumberger - Reflex 72v2
Schlumberger - Reflex USB
SCM Microsystems – SCR531-USB
Precise Biometric 250 MC
ActivIdentity* USB Reader 2.0 and 3.0
Smart Cards
Axalto Access 64K CAC
Gemplus GemXpresso* CAC
Oberthur CosmopolIC V4 CAC
Schlumberger Access 32K V2 CAC
Gemplus GemSAFE* SDK GPK16000
CryptoVision - CardOS M4.01a
Aladdin* - eToken PRO 64K
Oberthur CosmopolIC 64K V5.2 Fast ATR (PIV)
Web-Based Administration Using iManager
iManager version 2.6 SP2 with the NMAS plugin version 10.1.20061031
The NESCM iManager plug-in supports querying certificate information directly from smart cards.
This functionality is supported on Windows with the following browsers:
Firefox* 1.5x or later
Internet Explorer 6.0 SP2 or later
2.2 Installing the Method
Installation consists of installing the method on the eDirectory server and on the client
workstations.
2.2.1 eDirectory Server - Method Installation
The method is installed using iManager.
1Log in to iManager as an Administrator.

Novell Enhanced Smart Card Method Installation 13
novdocx (en) 6 April 2007
2From Roles and Tasks, select NMAS > NMAS Login Methods, then select New.
Figure 2-1 New Login Method
3Click Browse and select the EnhancedSmartCard.zip file that comes with the method.
This zip file contains the server components and the iManager components.
Figure 2-2 Specify Method File

14 Novell Enhanced Smart Card Method Installation Guide
novdocx (en) 6 April 2007
4Read and accept the license agreement.
Figure 2-3 License Agreement
5Review the method information and modify the values as needed.
If you don’t change the name, the default name (Enhanced Smart Card) is used for the method
and login sequence name.
Figure 2-4 Review Screen
6Click Finish.

Novell Enhanced Smart Card Method Installation 15
novdocx (en) 6 April 2007
7Review the installation summary page, then click Close.
Figure 2-5 Summary Screen
8Restart iManager to ensure that the plug-in is enabled.
2.2.2 Client Workstation Installation
The method must be installed on each workstation.
1Log in to each workstation as an Administrator.
2Run Setup.exe.
This installation program is located in the ...\enhancedsmartcard\client directory.
3Review the Welcome Screen, then click Next.
Figure 2-6 Welcome Screen

16 Novell Enhanced Smart Card Method Installation Guide
novdocx (en) 6 April 2007
4Accept the License Agreement, then click Next.
Figure 2-7 License Agreement
5Choose whether you need disconnected support, then click Next.
Disconnected support allows you to log in to the workstation locally using the smart card.
Figure 2-8 Disconnected Support Page

Novell Enhanced Smart Card Method Installation 17
novdocx (en) 6 April 2007
6If you want ID Plugin support, select Yes and specify the LDAP server’s DNS name or IP
address, then click Next.
Figure 2-9 ID Plugin Support Page
7(Conditional) If you selected ID Plugin support, you must also specify the container to search
and the search timeout period, then click Next.
The ID Plugin will do a sub-tree search starting at the specified base.
Figure 2-10 ID Plugin Options Page
8To use a custom password field description, select Customize password field description and
type the custom description, then click Next.

18 Novell Enhanced Smart Card Method Installation Guide
novdocx (en) 6 April 2007
Use an ampersand (&) in the description to enable Windows’ Alt+letter functionality. In the
example below, Alt+P would place focus on the field labeled with the “PIN:” description.
Figure 2-11 Customized Password Field Description
9Select the communication interface the method will use to connect to the smart card, then click
Next.
PC/SC functionality is the preferred interface. Select PKCS#11 if you know the smart card
middleware does not integrate with the Windows PC/SC functionality. If you select PKCS#11,
you must also specify a name of the module that is to be used.
Figure 2-12 Smart Card Interfaces Page
10 Click Install.
You can distribute the method to each workstation automatically using tools such as Zenworks®.
See Appendix A, “Silent Method Installation on Workstations,” on page 45 for detailed information
about scripting the method install.

Novell Enhanced Smart Card Method Installation 19
novdocx (en) 6 April 2007
Figure 2-13 Installation Screen

20 Novell Enhanced Smart Card Method Installation Guide
novdocx (en) 6 April 2007