Enable Smart Card Authentication in App Volumes Manager

Smart card authentication can be enabled in App Volumes Manager using the Enable Smartcard Authentication toggle. When the feature is enabled and a user navigates to App Volumes Manager admin UI, App Volumes Manager presents a certificate selection prompt. The user selects this certificate and App Volumes Manager performs a series of checks and validations.

For an understanding of how smart card user authentication workflow and checks and validation performed by App Volumes Manager, see Use Smart Card Authentication for App Volumes Manager.

Prerequisites

• Ensure that you have installed App Volumes agent 2606 and later.
  Smart card authentication is not supported in App Volumes agent running versions earlier than 2606.

• Ensure that when users authenticate using a smart card, the smart card contains a user certificate. Additionally, ensure that the smart cards are read by a compliant smart card reader.

Identity provider requirements

Active Directory

• If you intend to use Subject Alternative Name or Security Identifier as the certificate mapping method, then ensure that the Smartcard Logon certificate template is configured with the following extensions and values:

  • Subject Alternative Name

    App Volumes checks only for the UPN and email address field values. These values must be present in the following format:

    Field Value	Value Format
    UPN (User Principal Name)	UPN:value
    Email Address	RFC822 Name=value or email:value

  • Security Identifier (1.3.6.1.4.1.311.25.2)

• If you want to map certificates to a user in Active Directory using the altSecurityIdentities attribute, ensure that the attribute is configured with the (X.509) supported values.

  App Volumes Manager supports all six X509 mappings (X509IssuerSubject, X509SubjectOnly, X509RFC822, X509IssuerSerialNumber, X509SKI, and X509SHA1PublicKey) for this attribute. For more information about this attribute, see the Microsoft KB article.

  Note: To map certificates to a user in Entra ID, the certificateUserIds attribute must be used.

• To use certificate revocation checking, ensure that the following extensions and values are configured:

  Online Certificate Status Protocol (OCSP) and Certificate Revocation List (CRL) certificate revocation check methods are supported.

  • Authority Information Access (AIA) for OCSP

    This extension must contain a valid HTTP URL of an OCSP (Online Certificate Status Protocol) endpoint.

    • For OCSP, App Volumes Manager supports only HTTP endpoints.
    • If multiple URLs are listed in this extension, App Volumes Manager checks only the first URL.
    • If no OCSP URL is present in the AIA extension, App Volumes Manager will not perform OCSP revocation checks.
    • The App Volumes Manager server must be able to access the URL.

  • CRL Distribution Points

    This extension must contain a valid URL of a CRL endpoint.

    • The URL can be either HTTP or LDAP, as App Volumes Manager supports both HTTP and LDAP endpoints.
    • The App Volumes Manager server must be able to access the URL.

• Ensure that the root or intermediate certificate of the Certificate Authority is named as adCA.pem and placed in the App Volumes Manager server at: Install_location_of_App_Volumes\config.
  This path is required in the Nginx configuration file (nginx.conf).

• Ensure that the issued certificate has not expired and continues to remain in the validity period.

Entra ID

For Entra ID, Smart card authentication is supported only in a hybrid AD scenario — which is, Entra ID synchronized with on-premises Active Directory.

Nginx configuration requirements

Access the nginx.conf file at Install_location_of_App_Volumes\nginx\conf and update the server block where HTTPS (port 443) is enabled:

• Add the SSL directives in the SSL server block as follows:

  ssl_client_certificate /path/to/adCA.pem;      # Trusted CA bundle
  ssl_verify_client optional_no_ca;              # Allow both auth methods
  ssl_verify_depth 3;                            # Support intermediate CAs
  

• Add the proxy_set_header directives in the location @manager block as follows:

  proxy_set_header X-SSL-Client-Cert $ssl_client_escaped_cert;
  proxy_set_header SSL-Client-Verify $ssl_client_verify;
  proxy_set_header SSL-Client-S-DN $ssl_client_s_dn;
  proxy_set_header SSL-Client-I-DN $ssl_client_i_dn;
  proxy_set_header SSL-Client-Serial $ssl_client_serial;
  proxy_set_header SSL-Client-Fingerprint $ssl_client_fingerprint;
  

Procedure

1. Log in to App Volumes Manager and navigate to CONFIGURATION > Settings.

2. Turn on the Enable Smartcard Authentication toggle.

3. When the Information: Enable Smartcard Authentication dialog appears, review the notification about additional requirements and click OK.
   Additional configuration fields are displayed.

4. (Optional) In the CRL Distribution Point URL field, enter the URL of your CRL endpoint. This field accepts HTTP and LDAP URLs.
   For App Volumes to prefetch CRL data, configure this field.
   If the field is configured, App Volumes prefetches the CRL data from the CRL endpoint when the Refresh CRL background job runs at configured intervals. For information about the background job, see Background Jobs in App Volumes Manager.

   Note: If the CRL data exceeds the default limit (1024 KB), the CRL revocation check is considered inconclusive. This limit can be configured. If you need to change this limit, contact Omnissa Support.

5. (Optional) In the Certificate Mappings field, enter a comma-separated list of user identifiers.
   If the field is left empty, App Volumes Manager evaluates SID, UPN, and email address in that order by default. For more information about this field, see the How App Volumes handles mapping a certificate to a user account section in Use Smart Card Authentication for App Volumes Manager.

6. Click Save.

   Smart card authentication is now active. Users who navigate to the App Volumes Manager login page will see a certificate selection prompt.

What to do next

For troubleshooting errors, see Error Scenarios - Smart Card Authentication for App Volumes Manager.