Assume you have a user who has a Smartcard with a private key and a signed certificate from an external source. How can the user use the Smartcard for authentication?
With Red Hat Identity Management this is quite easy. You only have to identify the related user object ...
and add the certificate to the user object.
To enable Smartcard authentication on the client you have to make sure ...
a PKCS#11 module is added to the system's /etc/pki/nssdb ...
... all needed CA certificates to validate the certificate on the Smartcard are installed ...
... and that Smartcard authentication is enabled in sssd.conf.
Now make sure the Smartcard is inserted into the reader and try to login as the user.
Instead of a password you are now asked for the PIN of the Smartcard.
Smartcards and SSH both use public and private keys to allow secure authentication. OpenSSH offers support to use the keys from a Smartcard instead of the default ssh-keys.
On the client side where the reader is connected SSH must be made aware of a PKCS#11 module which will offer access to the Smartcard.
Now the PIN is requested to allow the needed crypto operations with the private key on the Smartcard.
On the server side RH IdM will automatically make the public key of the certificate from the user entry available as SSH authorized key.
Now we switch back to the RH IdM admin console.
If the RH IdM domain has a trust to an Active Directory domain the Smartcard authentication can be made available for AD users as well
If the certificate cannot be added to the user object in AD the RH IdM user overrides can be used.
It is the same as for IPA users only that the certificate is added to the override object of the AD user.
Now make sure the Smartcard of the AD user is in the reader an try to log in.
Again the Smartcard PIN is requested instead of a password.
We have already seen that the ssh command supports Smartcards for authentication.
But the SSH authentication agent can be made aware of the Smartcard as well.
Now ssh does not has to prompt for the PIN because the SSH authentication agent already knows it.
Trying to log in to another remote host will ask for a password because the remote host does not have access to the Smartcard.
But if the SSH authentication agent forwarding feature is used ...
Even remote hosts can benefit from the Smartcard with the help of the forwarded SSH authentication agent.