Configure Smart Card Redirection on a RHEL or Rocky Linux 9.x/8.x VM

To configure smart card redirection on a RHEL or Rocky Linux 9.x/8.x virtual machine (VM), install the libraries on which the feature depends and the root Certificate Authority (CA) certificate to support the trusted authentication of smart cards.

Prerequisites

• Integrate a RHEL or Rocky Linux 9.x/8.x VM with AD for Smart Card Redirection
• To use the smart card single sign-on (SSO) feature in FIPS mode, ensure that you have completed all the steps described in Configure a FIPS-compliant Linux Machine. You must add the trusted CA certificate for BlastServer to /etc/omnissa/ssl/rui.crt and add the key paired with rui.crt to /etc/omnissa/ssl/rui.key.

Procedure

1. Install the required libraries.

   sudo yum install -y opensc pcsc-lite pcsc-lite-libs pcsc-lite-ccid nss-tools
   

2. Enable the pcscd service.

   sudo systemctl enable pcscd
   sudo systemctl start pcscd
   

3. Modify the /etc/sssd/sssd.conf configuration file as shown in the following example. Under the [pam] section, specify pam_cert_auth = True.

   [sssd]
   domains = domain.com
   config_file_version = 2
   services = nss, pam
   
   [domain/mydomain.com]
   ad_domain = mydomain.com
   krb5_realm = MYDOMAIN.COM
   realmd_tags = manages-system joined-with-adcli
   cache_credentials = True
   id_provider = ad
   krb5_store_password_if_offline = True
   default_shell = /bin/bash
   ldap_id_mapping = True
   use_fully_qualified_names = False             #Use short name for user
   fallback_homedir = /home/%u@%d
   access_provider = ad
   
   [pam]                                 #Add pam section for certificate logon
   pam_cert_auth = True                  #Add this line to enable certificate logon for system
   

4. Get a root Certificate Authority (CA) certificate or certificate chain as described in How to export Root Certification Authority Certificate, and install the certificate.

   a. Locate the root CA certificate or certificate chain that you downloaded, and transfer it to a PEM file.

   sudo openssl x509 -inform der -in /tmp/certificate.cer -out /tmp/certificate.pem
   

   b. Copy the certificate to the /etc/sssd/pki/sssd_auth_ca_db.pem file.

   sudo cp /tmp/certificate.pem /etc/sssd/pki/sssd_auth_ca_db.pem
   

5. To verify the status of the smart card, run the following pkcs11-tool commands and confirm that they return the correct output.

   sudo pkcs11-tool -L
   
   sudo pkcs11-tool --login -O
   
   sudo pkcs11-tool --test --login
   

6. To support the smart card SSO feature and the Horizon greeter when SSO is deactivated, configure the /etc/omnissa/viewagent-greeter.conf file. See Edit Configuration Files on a Linux Desktop.

7. Install the Horizon Agent package, with smart card redirection enabled.

Note: The examples below use the name agent-installer.el8.x86_64.rpm to refer to the RPM installer file. Subtitute the specific file name for your installation.

-   If using the `.rpm` installer:

    a.  Run the installer to install Horizon Agent with the default feature options.

        ```
        sudo rpm -ivh agent-installer.el8.x86_64.rpm
        ```

    b.  To add the smart card redirection feature, run the `ViewSetup.sh` script.

        ```
        sudo /usr/lib/omnissa/viewagent/bin/ViewSetup.sh -m yes
        ```

-   If using the `.tar.gz` installer, run the installer with the parameter to enable smart card redirection:

    ```
    sudo ./install_viewagent.sh -m yes
    ```

**Note:** If you get an error message instructing you to install the default PC/SC Lite library, uninstall the custom PC/SC Lite library that is currently present on the machine and install the default PC/SC Lite library using the following command.

```
sudo yum reinstall pcsc-lite-libs pcsc-lite
```

You can then run the Horizon Agent installer.

9. If you are using a custom PC/SC Lite library, configure the pcscd.maxReaderContext and pcscd.readBody options in the /etc/omnissa/config file.

See [Edit Configuration Files on a Linux Desktop](EditConfigurationFilesonaLinuxDesktop.md).

10. Restart the virtual machine and log back in.