Configure Smart Card Redirection for RHEL and Rocky Linux 9.x/8.x Desktops

To set up smart card direction for RHEL and Rocky Linux 9.x/8.x desktops, first integrate the base virtual machine (VM) with your Active Directory (AD) domain. Then install the necessary libraries and root CA certificate before installing Horizon Agent.

Placeholders used in examples

Some examples in the procedure use placeholder values to represent entities in your network configuration, such as the DNS name of your AD domain. Replace the placeholder values with information specific to your configuration, as described in the following table.

Note: The steps below use the name agent-installer.el8.x86_64.rpm to refer to the RPM installer file.

Procedure

1. On the base VM, do the following.

   a. Configure network and DNS settings as required by your organization.

   b. Turn off IPv6.

   c. Turn off Automatic DNS.

2. Install the required dependency packages.

   sudo yum install oddjob oddjob-mkhomedir sssd adcli samba-common-tools krb5-pkinit
   sudo yum install -y opensc pcsc-lite pcsc-lite-libs pcsc-lite-ccid nss-tools
   

3. Edit the /etc/krb5.conf configuration file so that it resembles the following example.

   # To opt out of the system crypto-policies configuration of krb5, remove the
   # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
   includedir /etc/krb5.conf.d/
   
   [logging]
       default = FILE:/var/log/krb5libs.log
       kdc = FILE:/var/log/krb5kdc.log
       admin_server = FILE:/var/log/kadmind.log
   
   [libdefaults]
       dns_lookup_realm = false
       ticket_lifetime = 24h
       renew_lifetime = 7d
       forwardable = true
       rdns = false
       pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
       spake_preauth_groups = edwards25519
       default_realm = DOMAIN.COM
       default_ccache_name = KEYRING:persistent:%{uid}
   
   [realms]
    DOMAIN.COM = {
        kdc = dnsserver.domain.com
        admin_server = dnsserver.domain.com
        default_domain = dnsserver.domain.com
        pkinit_anchors = FILE:/etc/pki/nssdb/certificate.pem
        pkinit_cert_match = <KU>digitalSignature
        pkinit_kdc_hostname = dnsserver.domain.com
    }
   
   [domain_realm]
    .domain.com = DOMAIN.COM
    domain.com = DOMAIN.COM
   

4. On the base VM, verify the network connection to the AD domain.

   sudo realm discover domain.com
   

5. Join the AD domain.

   sudo realm join --verbose domain.com -U AdminUser
   

   Running the join command returns output similar to the following example.

   Enter AdminUser's password:
   Using short domain name -- DOMAIN
   Joined 'rhelsc' to dns domain 'domain.com'
   

6. Enable the pcscd service.

   sudo systemctl enable pcscd
   sudo systemctl start pcscd
   

7. Modify the /etc/sssd/sssd.conf configuration file as shown in the following example. Under the [pam] section, specify pam_cert_auth = True.

   [sssd]
   domains = domain.com
   config_file_version = 2
   services = nss, pam
   
   [domain/mydomain.com]
   ad_domain = mydomain.com
   krb5_realm = MYDOMAIN.COM
   realmd_tags = manages-system joined-with-adcli
   cache_credentials = True
   id_provider = ad
   krb5_store_password_if_offline = True
   default_shell = /bin/bash
   ldap_id_mapping = True
   use_fully_qualified_names = False             #Use short name for user
   fallback_homedir = /home/%u@%d
   access_provider = ad
   
   [pam]                                 #Add pam section for certificate logon
   pam_cert_auth = True                  #Add this line to enable certificate logon for system
   

8. Specify the system identity and authentication sources.

   sudo authselect select sssd with-smartcard with-mkhomedir
   

9. Get a root Certificate Authority (CA) certificate or certificate chain as described in How to export Root Certification Authority Certificate, and install the certificate.

   a. Locate the root CA certificate or certificate chain that you downloaded, and transfer it to a PEM file.

   sudo openssl x509 -inform der -in /tmp/certificate.cer -out /tmp/certificate.pem
   

   b. Copy the certificate to the /etc/sssd/pki/sssd_auth_ca_db.pem file.

   sudo cp /tmp/certificate.pem /etc/sssd/pki/sssd_auth_ca_db.pem
   

10. To verify the status of the smart card, run the following pkcs11-tool commands and confirm that they return the correct output.

    sudo pkcs11-tool -L
    
    sudo pkcs11-tool --login -O
    
    sudo pkcs11-tool --test --login
    

11. To support the smart card SSO feature and the Horizon greeter when SSO is deactivated, configure the /etc/omnissa/viewagent-greeter.conf file. See Edit Configuration Files on a Linux Desktop.

12. Install the Horizon Agent package, with smart card redirection enabled.

    • If using the .rpm installer:

      a. Run the installer to install Horizon Agent with the default feature options.

      sudo rpm -ivh agent-installer.el8.x86_64.rpm
      

      b. To add the smart card redirection feature, run the ViewSetup.sh script.

      sudo /usr/lib/omnissa/viewagent/bin/ViewSetup.sh -m yes
      

    • If using the .tar.gz installer, run the installer with the parameter to enable smart card redirection:

      sudo ./install_viewagent.sh -m yes
      

    Note: If you get an error message instructing you to install the default PC/SC Lite library, uninstall the custom PC/SC Lite library that is currently present on the machine and install the default PC/SC Lite library using the following command.

    sudo yum reinstall pcsc-lite-libs pcsc-lite
    

    You can then run the Horizon Agent installer.

13. If you are using a custom PC/SC Lite library, configure the pcscd.maxReaderContext and pcscd.readBody options in the /etc/omnissa/config file.

    See Edit Configuration Files on a Linux Desktop.

14. Restart the virtual machine and log back in.