Hello all,

I already know that it is possible to replace Windows Active Directory with Samba Primary Domain Controller and have Windows clients join Samba PDC (at least I have tested it successfully with Windows XP and Samba 3 on Lutuntu) and login using username and password.

But now I am trying to move a step forward into smart card logon.

Is it possible to have a Linux based server that can be used to provide Windows smart card logon?
Is there any guide that can help me implement such a solution? My search on Google hasn't been successful.
(I prefer a solution based on CentOS if it is possible)

I appreciate any help you can provide me.
Thank you.

Hi,

I'm currently working on smartcard logon as well. I've been able to setup one with Windows Server 2008 and Windows 7 for the client. I must say I'm a little pessimistic concerning a Linux alternative on the server side. This doc shows how a smartcard logon is performed within a Windows environment. As you can see, not only an Active Directory is needed, but a lot of other services.

Since you asked, I assume you really need an online (Active Directory) logon ? Because if you're interested in an offline (local) smartcard logon, you might want to take a look at EIDAuthenticate.

Don't hesitate to ask for more information and tell us if you find your answer !

Cheers

Yes I need online logon.

I've read that Samba 4 supports smart card logon but I can't find a guide for it.

Yeah, it seems that it doesn't exist yet. But you still have plenty of information to read when googling.

Tell us if you find a solution !

Cheers

Current status:
I have already installed Samba 4 and joined a Windows XP PC and Windows 7 PC in the domain successfully.
I am trying to make Heimdal to work with certificates, i.e. I'm in "Configure Heimdal to accept PKINIT" step of the not existing yet guide on Samba wiki.

I have asked for help in the Samba list http://www.spinics.net/lists/samba/msg102522.html

I will keep updating this thread whenever I have something new to add.

Status update:

Documentation to configure Heimdal to accept PKINIT can be found in http://www.h5l.org/manual/HEAD/info/..._002dINIT.html

I couldn't find hxtool in Samba 4, so I had to download and built (no need to install though) Heimdal first.

Next step, is to configure Samba 4 to know about the certificate.

1 members found this post helpful.