The purpose of this guide is to demonstrate the process of setting up a smart card for authentication in MetaDefender Kiosk. In this example, we use a Yubikey smart card. Please note that this guide is for reference only, for the most accurate instructions, refer to the setup documentation provided by your smart card providers.
Smart card authentication requires proper setup and configurations on Domain Controllers, Active Directory and Kiosk.
- Root Certificate Authority (CA) certificate must be created
- Domain Controllers must be configured and trust the root CA certificate
- Kiosk host machine must join the domain
The instruction bellow assumes requirements mentioned above have been met. Configuring these requirements are out of the scope of this document.
Kiosk 4.7.2 or later should support all ISO 7816-compliant microprocessor-based and FIPS 201 standard smart cards such as PIV smart card.
If Further Assistance is required, please proceed to log a support case or chat with our support engineer.
1. Certificate Template configuration
Step 1. Open Certificate Template
- Press Win + R, type mmc, and open it with Administrator permissions
- In the MMC window, select File, select Add/Remove Snap-in. From the list, select Certificate Template and click Add. Then, click OK.
Step 2. Duplicate two highlighted certificate templates (Enrollment Agent and Smartcard Logon) to create your own Smartcard certificate Template.
- Right-click on each of these templates. Select Duplicate Template.
Step 3. Setup for Enrollment Agent template
Go to General tab:
- Change Template display name to <domain-name> Enrollment Agent. e.g Yubikey
- Set Validity period to 2 years
- Set Renewal period to 6 weeks
- Enable Publish certificate in Active Directory
- Enable Do not automatically reenroll if a duplicate certificate exists in Active Directory
Go to Security tab
- Add Read, Write and Enroll permissions to Authenticated Users
- Click OK to duplicate the template
Step 4. Setup for Smartcard Logon template
Duplicate Smartcard Logon template
Go to Cryptography tab
Set the following values
- Provider Category to Key Storage Provider
- Algorithm name to ECDH_P256
- Minimum key size to 256
Select Requests must use one of the following providers, and enable Microsoft Smart Card Key Storage Provider
Go to Subject Name tab
- Select Build from this Active Directory information. Under Subject name format, select Fully distinguished name and enable User principal name (UPN)
Go to Issuance Requirements tab
- Enable This number of authorized signatures, and set value of 1
- Under Policy type required in signature, select Application policy
- Under Application policy, select Certificate Request Agent
Go to Request Handling tab
- Under purpose, select Signature and encryption, and enable For automatic renewal of smart card certificates, use the existing key if a new key cannot be created
- Select Prompt the user during enrollment
- Click OK to duplicate the template
2. Enrollment Agent certificate
Step 1. Open Certificate Manager
- Press Win + R, type certmgr.msc, and open it with Administrator permissions
Step 2. Request new certificate
- Under Certificate Manager, right-click on Personal, select All Tasks, select Request New Certificate
- in Certificate Enrollment Policy, select Next to continue
- Select <domain-name> Enrollment Agent created in previous steps, click on Properties
- Provide a friendly name for this certificate, click Apply, then click OK
- Click Finish to end the process
- A new Enrollment Agent certificate is now created and shown under Certificate section.
3. User Enrollment
Step 1. Open Certificate Manager
- Press Win + R, type certmgr.msc, and open it with Administrator permissions
Step 2. Enroll Users
- In Certificate Manager, Right-click on Personal, Select All Tasks, Select Advanced Operations, Select Enroll on Behalf of...
- Keep default settings and click Next until Select Enrollment Agent Certificate. Click Browse. Select a certificate for Enrollment Agent
- Select <domain-name> Smartcard template created from previous steps. Click Next
- Click Browse and select the user to enroll it to smart card. Click Enroll to finish the process
Insert the Yubikey to the computer
Enter the PIN and click OK
Wait for the enrollment to finish and click Close to exit, or click Next user to enroll another user
When multiple users were enrolled to the smart card, Kiosk will only grant access to the most recent enrolled user.
4. Install Smart Card Reader driver on the Kiosk machine
On the Kiosk machine, it is essential to install the appropriate drivers for your smart card Reader
- Go to the provider website to download the driver required for your Kiosk machine Smart Card Drivers and Tools | Yubico
- Please follow the provider's instruction to install the driver properly.
5. Enable smart card detection on Kiosk configuration
- From Kiosk Management Console, navigate to Workflows, click on Set Default Login Method. Select MetaDefender kiosk Authentication, select Remote Active Directory, check Enable smart card authentication.
To use smart card authentication, Active Directory must be enabled and configured.
