Applies to: Centrify DirectControl Suite 2013.3 on RHEL5 and RHEL6 with Smart Card Support
How can a 3rd party PKCS#11 module be supported other than the Coolkey module shipped for RedHat?
Run "sctool -s" to checks the status of smart card support.
The screenshot below shows what happens when required packages are missing.
It is essential to have the RedHat SmartCard package in order to apply the 3rd party PKCS#11 module steps below:
To enable smart card support please check:
KB-3415: How to enable Smart Card logon support on Red Hat Environments?
The Centrify Coolkey module is hardcoded to be used in the RHSC components.
This Coolkey module is always configured to be used by the system components when RHSC support is enabled
3rd party PKCS#11 modules are not included in the Centrify package. They can be installed any time either before or after the installation of CDC...
But they MUST be installed before applying the GPs below to configure the 3rd party module.
Only one PKCS#11 module can be active at a given time.
If a 3rd party PKCS#11 module has been specified, Centrify's default Coolkey module will not be active.
To support 3rd party PKCS#11 modules:
Directly edit the parameter in /etc/centrifydc/centrifydc.conf to configure which PKCS#11 module to use.
The default value is to use the Centrify Coolkey module:
After saving the configuration file as root, reload the config and restart the sctool:
/usr/bin/sctool -d && /usr/bin/sctool -e
Optionally, GNOME can also be refreshed to reflect the change
After applying the GP, run the following command on the RHEL machine:
This setting can also be deployed via GP:
Computer Configuration / Centrify Settings / Linux Settings / Security / "Enable smart card support" > Specify PKCS#11 module
Admin should ensure that 3rd party PKCS#11 module has been installed on client machines before proceeding to #2.
2. Either manually set or create a new GP to configure which 3rd party PKCS11 module to be used. Absolute paths should be used.
NOTE: Env variables like $LIB are supported.
3. adreload / adgpupdate is necessary to see the change immediately.
3rd party PKCS#11 should work as expected
3rd party PKCS11 module might not work well with gdm.
Certain card event operations, such as Screen Lock upon card removal, would not work in these cases.
Centrify will not patch anything to handle this as it is due to the feature set of either gdb or the module itself.