Configure Smart Card Redirection With SSSD for Ubuntu/Debian Desktops

To set up smart card direction with SSSD for desktops running Ubuntu or Debian, first integrate the base virtual machine (VM) with your Active Directory (AD) domain. Then install the necessary libraries and root Certificate Authority (CA) certificate before installing Horizon Agent.

Placeholders in examples

Some examples in the following procedure use placeholder values to represent entities in your network configuration, such as the DNS name of your AD domain. Replace the placeholder values with information specific to your configuration, as described in the following table.

Procedure

1. Install the required dependency packages.

   sudo apt-get install sssd-tools sssd libnss-sss libpam-sss adcli samba-common-bin krb5-user krb5-pkinit
   
   sudo apt-get install -y pcscd pcsc-tools pkg-config libpam-pkcs11 opensc libengine-pkcs11-openssl libnss3-tools
   

2. On the base VM, verify the network connection to Active Directory.

   sudo realm discover domain.com
   

3. Join the AD domain.

   sudo realm join --verbose domain.com  -U AdminUser
   

4. Get a root Certificate Authority (CA) certificate or certificate chain as described in How to export Root Certification Authority Certificate, and install the certificate.

   a. Locate the root CA certificate or certificate chain that you downloaded, and transfer it to a PEM file.

   sudo openssl x509 -inform der -in /tmp/certificate.cer -out /tmp/certificate.pem
   

   b. Copy the certificate to the /etc/sssd/pki/sssd_auth_ca_db.pem file.

   sudo cp /tmp/certificate.pem /etc/sssd/pki/sssd_auth_ca_db.pem
   

5. Edit the /etc/krb5.conf configuration file so that it resembles the following example.

   # To opt out of the system crypto-policies configuration of krb5, remove the
   # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
   includedir /etc/krb5.conf.d/
   
   [logging]
       default = FILE:/var/log/krb5libs.log
       kdc = FILE:/var/log/krb5kdc.log
       admin_server = FILE:/var/log/kadmind.log
   
   [libdefaults]
       dns_lookup_realm = false
       ticket_lifetime = 24h
       renew_lifetime = 7d
       forwardable = true
       rdns = false
       pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
       spake_preauth_groups = edwards25519
       default_realm = DOMAIN.COM
       default_ccache_name = KEYRING:persistent:%{uid}
   
   [realms]
    DOMAIN.COM = {
        kdc = dnsserver.domain.com
        admin_server = dnsserver.domain.com
        default_domain = dnsserver.domain.com
        pkinit_anchors = FILE:/etc/pki/nssdb/certificate.pem
        pkinit_cert_match = <KU>digitalSignature
        pkinit_kdc_hostname = dnsserver.domain.com
    }
   
   [domain_realm]
    .domain.com = DOMAIN.COM
    domain.com = DOMAIN.COM
   

6. Add pam_sss to the PAM configuration.

   sudo pam-auth-update --disable sss-smart-card-required --enable sss-smart-card-optional
   

7. To verify that the smart card hardware and the certificates are installed on the smart card, run the following commands.

   sudo pcsc_scan
   sudo pkcs11_listcerts
   sudo pkcs11_inspect
   

8. To support the smart card SSO feature and the Horizon greeter when SSO is deactivated, configure the viewagent-greeter.conf file. See Edit Configuration Files on a Linux Desktop.

9. Install the Horizon Agent package, with smart card redirection enabled.

   sudo ./install_viewagent.sh -m yes
   

   Note: If you get an error message instructing you to install the default PC/SC Lite library, uninstall the custom PC/SC Lite library that is currently present on the machine and install the default PC/SC Lite library using the following command.

   sudo apt-get install --reinstall pcscd libpcsclite1
   

   You can then run the Horizon Agent installer.

10. If you are using a custom PC/SC Lite library, configure the pcscd.maxReaderContext and pcscd.readBody options in the Horizon config file.

    See Edit Configuration Files on a Linux Desktop.

11. Restart the VM and log back in.