User manual APPLE SMART CARD SETUP GUIDE

[. . . ] Smart Card Setup Guide K Apple Computer, Inc. © 2006 Apple Computer, Inc. All rights reserved. Under the copyright laws, this manual may not be copied, in whole or in part, without the written consent of Apple. The Apple logo is a trademark of Apple Computer, Inc. , registered in the U. S. Use of the "keyboard" Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. [. . . ] 10 Make the following changes to the mechanisms array within the authenticate dictionary. a Add <string>builtin:smartcard-sniffer, privileged</string> to the beginning of the mechanisms array. b Delete <string>authinternal</string>. c Add <string>builtin:authenticate, privileged</string> after the item <string>builtin:authenticate</string>. 11 Save your changes. 12 Your original session should still be running in Terminal. To replace the actual authorization file with the edited version, enter: cp /tmp/authorization. mod /etc/authorization The changes take place immediately; you don't need to restart the system. After smart card login is enabled, the system starts checking whether a card reader is attached to the computer. Unlike with previous versions of smart card software, you do not need to enter additional commands for your computer to recognize the reader. Chapter 2 Setting Up Your Smart Card 7 Setting Up an Account for Smart Card Access You must have a user account to bind to the smart card, and then configure that account to work properly with the smart card. Follow these instructions to set up a user account for a smart card. Setting Account Preferences Use the Accounts preferences pane in System Preferences to create or configure the user account that will be bound to the smart card. To create or configure a user account for a smart card: 1 Choose Apple () menu > System Preferences, and then click Accounts. 2 If some settings are dimmed, click the lock icon and then enter an administrator name and password. 3 Select the user account you want to change, or if you want to create a new user, click Add (+) and then enter the user's name and password in the Name, Password, and Verify fields. If you don't want to use the automatically generated short name, enter a new short name. (After the account is created, you won't be able to change the short name). 4 If you want the user to have administrator privileges, click Password and select the option "Allow user to administer this computer. " 5 Click Login Options. 6 Deselect the option "Automatically log in as. " 7 Deselect the option "Show the Restart, Sleep, and Shut Down buttons. " 8 Deselect the option "Enable fast user switching. " 9 Close System Preferences. Securing Your Idle Computer If you want to be sure that the computer is secured when it is idle, you can require users to authenticate using the smart card and PIN when they wake the computer from sleep or return to the desktop from a screen saver. To require user authentication: 1 Open System Preferences, and then click Security. 2 If some settings are dimmed, click the lock icon and then enter an administrator name and password. 3 Select the option "Require password to wake this computer from sleep or screen saver. " 4 Close System Preferences. 8 Chapter 2 Setting Up Your Smart Card Using Keychain Access You must set up Keychain Access to work with your organization's policy. There are two common methods for verifying the validity of a certificate: Online Certificate Status Protocol (OCSP) and Certificate Revocation List (CRL). Information about the status of certificates is stored on a revocation server. The Mac OS X security system can check with the revocation server to validate the certificate. [. . . ] Check with your network administrator for configuration information specific to your directory service. Chapter 2 Setting Up Your Smart Card 11 Modifying the Configuration File for Attribute Lookup In most directory services you will use a configuration file that contains a search key for an Open Directory search. A configuration file is an array of dictionaries. Each dictionary in this array contains one search key in an Open Directory search. The default configuration file is: /etc/caclogingconfig. plist The following example shows a common configuration: <dict> <key>dsAttributeString</key> <string>dsAttrTypeNative:userPrincipalName</string> <key>fields</key> <array> <string>NT Principal Name</string> </array> <key>formatString</key> <string>$1</string> </dict> The dsAttrTypeNative: string is followed by the ntprincipalname token, which represents the name of the attribute to use in your directory schema. [. . . ]