Return
-
Title
VAS Smart Card Test failing on Mac OS, error regarding wrong realm name in certificate -
Description
We are attempting to configure Mac OS for smart card login with QAS 4.2. There are no issues testing the card or reader, however when running 'vastool smartcard login test' the following error gets returned:
vas_id_establish_cred_pkcs11: Failed to get initial cred. failed
ERROR: could not establish initial credentials
ERROR: VAS_ERR_KRB5: Kerberos error Failed to obtain credentials.
Client: USER@EXAMPLE.COM, Service: krbtgt/EXAMPLE.COM@EXAMPLE.COM, Server: dc01.example.com Caused by: KRB5_KDC_ERR_INVALID_CERTIFICATE (-1765328313): Certificate invalid Reason: KDC have wrong realm name in the certificate -
Cause
Due to changes in the kerberos library that are used in QAS 4.2, a few new options are needed to allow for authentication with smartcards. -
Resolution
A realm section in vas.conf was needed for the domain EXAMPLE.COM. The sections should look something like this:[realms]EXAMPLE.COM = {pkinit_require_eku = falsepkinit_require_krbtgt_otherName = falsepkinit_trustedCertifiers = false}A similar block would need to be set up for every domain that you wish to use smartcards with.