Use the information presented in this topic to understand and troubleshoot the error scenarios that might occur when using smart card authentication for App Volumes Manager.
For more information about using smart card authentication in App Volumes Manager, see Use Smart Card Authentication for App Volumes Manager and Enable Smart Card Authentication in App Volumes Manager.
Error Scenario: Smartcard authentication is not enabled. Please contact your administrator
Cause: The Enable Smartcard Authentication setting is not enabled.
Solution: To enable the setting in the App Volumes Manager admin UI, navigate to CONFIGURATION > Settings. By default, the setting is not enabled.
Error Scenario: Your smart card authentication is not valid or has expired
Cause: This error can occur due to the following reasons:
-
X.509 certificate has expired or not valid yet.
-
OCSP responder might be slow or not reachable or the OCSP signature cannot be verified.
-
CRL Distribution point is not reachable or CRL response signature is not valid.
-
CRL data is too large.
-
App Volumes Manager might be using cached or stale data for CRL revocation check.
Solution: To resolve this error, you can try one of the following:
-
To ensure that the X.509 certificate has not expired, check the validity dates.
-
Ensure that App Volumes Manager can reach the OCSP and the CRL Distribution Point URLs present in the X.509 certificate.
-
Ensure that the CRL data is within the default limit,
1024 KB. -
Wait for the Refresh CRL background job to run at the configured interval. When this job runs, App Volumes Manager prefetches CRL data from the CRL endpoint. This data is stored in the App Volumes Manager server virtual machine. For information about the background job, see Background Jobs in App Volumes Manager.
Error Scenario: Your smartcard certificate does not contain a valid user identifier. Please contact your administrator
Cause: This error can occur due to the following reasons:
-
Smart card certificate does not contain a valid user identifier.
-
App Volumes Manager is not able to map the X.509 certificate with any user account in the identity provider (Active Directory or Entra ID) using any of the user identifiers: SID, UPN, Email address, or Certificate mappings.
Solution: Ensure that the X.509 certificate has the correct user based on the default or configured user identifiers. For more information about the user identifiers, see the How App Volumes maps certificates to user accounts section in Use Smart Card Authentication for App Volumes Manager.
Error Scenario: X.509 certificate is not seen in the browser as a prompt
Cause: This error can occur due to the following reasons:
-
The browser does not detect the smart card.
-
The browser continues to access a stale X.509 certificate which was selected in the previous login.
Solution: To resolve this error, you can try one of the following:
-
Ensure that the machine into which the smart card device is plugged into, recognizes the X.509 certificate.
-
Ensure that the SSL directives and proxy_set_header directives are added in the nginx.conf file.
-
If you have selected an incorrect certificate, close and reopen the browser before selecting the correct certificate. Closing and reopening the browser ensures that the TLS session is cleared and no stale certificate is present.
Error Scenario: Administrator is automatically logged in to App Volumes Manager even after logging out
Cause: If you do not close the browser window after logging out of App Volumes Manager (only for smart card authentication based login), you get automatically logged into App Volumes Manager again after 2 minutes.
Solution: After logging out of App Volumes Manager, close the browser session. Only closing the browser completes the logging out process. This action is necessary even when you remove the smart card because App Volumes Manager does not detect smart card removal.
Was this page helpful?