Use Smart Card Authentication for App Volumes Manager

Smart card authentication strengthens the security of your App Volumes Manager environment by allowing users to log in using physical smart card credentials. When this feature is enabled, App Volumes Manager validates the X.509 certificate presented by the user's smart card, maps the certificate to an Active Directory user account, and establishes a session. Traditional username and password authentication continues to be available.

This topic explains the authentication workflow, certificate validation, and certificate-to-user mapping.

Smart card user authentication workflow

The following describes the end-to-end authentication workflow for a user logging in with a smart card:

1. The user navigates to the App Volumes Manager web login page.

2. App Volumes Manager displays a certificate selection prompt. The user selects the appropriate certificate from their smart card.

3. If the smart card requires additional authentication, the user must enter the corresponding credentials when prompted.

4. App Volumes Manager performs a series of checks and validations to authenticate the user.
   For the list of checks and validations, see List of Checks and Validations for Smart Card Authentication.

5. After the checks and validations are successful, the user can access App Volumes Manager. If the authentication fails, App Volumes Manager redirects the user to the login screen and prompts the user to contact the administrator.

Smart card authentication checks and validations

After the prerequisites are set up, the feature can be enabled in App Volumes Manager using the Enable Smartcard Authentication toggle. When the feature is enabled and a user navigates to App Volumes Manager admin UI, App Volumes Manager presents a certificate selection prompt. The user selects this certificate, and App Volumes Manager then performs the following checks and validations:

1. Certificate validation

   App Volumes Manager verifies that the presented certificate is a valid X.509 certificate issued by a trusted certificate authority (CA).

2. Revocation check

   App Volumes Manager checks whether the certificate is revoked. The revocation check is first performed using the OCSP (Online Certificate Status Protocol) protocol. In this method, App Volumes Manager checks for a URL in the certificate's Authority Information Access (AIA) extension. If the OCSP check is inconclusive or the AIA extension is absent, App Volumes Manager does a CRL (Certificate Revocation List) check using the URL in the CRL Distribution Points extension.

   When using the CRL revocation check, App Volumes Manager downloads the CRL and verifies whether the certificate is present in the CRL. If the certificate is present in the CRL, it means that the certificate is revoked. Hence, App Volumes Manager does not allow access to the user.

   If both checks are inconclusive, App Volumes Manager considers the certificate as revoked and denies access to the user by default. This behavior ensures that certificates with uncertain revocation status are never accepted. To change this default behavior, contact Omnissa Support.

   A CRL Distribution Point URL field is present in the App Volumes Manager UI. This field can be used to configure App Volumes to prefetch CRL data. If the CRL data exceeds the default limit (1024 KB), the CRL revocation check is considered inconclusive.

3. User identification

   App Volumes Manager maps the certificate to the user using the user identifiers in the order as specified in the Certificate Mappings field. After a user is successfully identified, App Volumes Manager stops checking the rest of the list. If none of the user identifiers produce a match, authentication fails and App Volumes Manager redirects the user to the login screen and prompts the user to contact the administrator.
   If the Certificate Mappings field is empty, App Volumes Manager uses SID, UPN, and email address by default to match the user with the certificate.

4. Authentication

   After the certificate is mapped to the user, App Volumes Manager performs an LDAP bind to Active Directory to verify the account and create a session.

If the certificate cannot be validated or the user cannot be identified, App Volumes Manager displays the Active Directory username and password login screen.

How App Volumes maps certificates to user accounts

App Volumes Manager maps the X.509 certificate to an Active Directory user account using the following user identifiers:

1. Security Identifier (SID)
2. UPN (User Principal Name) format
3. Email address
4. Certificate mappings (altSecurityIdentities)
   The X509 values are: X509IssuerSubject, X509SubjectOnly, X509RFC822, X509IssuerSerialNumber, X509SKI, and X509SHA1PublicKey

The Certificate Mappings setting in the App Volumes Manager admin UI can be used to control how and in what order the user identifiers are evaluated. This field accepts a comma-separated list of the user identifiers and App Volumes evaluates these identifiers in the order of the list. The supported values include SID, UPN, Email, and the six X.509 supported values for altSecurityIdentities.

If the field is empty, then SID, UPN, and email address are evaluated in this order by default.

To enable the smart card authentication feature, see Enable Smart Card Authentication in App Volumes Manager.