Chat now with support
Chat with Support

Safeguard Authentication Services 4.1.5 - Authentication Services for Smart Cards Administration Guide

One Identity Privileged Access Suite for Unix Introducing Authentication Services for Smart Cards Installing Authentication Services for Smart Cards Configuring Authentication Services for Smart Cards
Configuring the vendor’s PKCS#11 library Configuring the card slot for your PKCS#11 library Configuring PAM applications for smart card login Configuring certificates and CRLs
Testing Authentication Services for Smart Cards Troubleshooting

Configuring KDM

The K Display Manager (KDM) is a PAM application providing graphical login. The following sections document how to configure and use KDM with smart card authentication.

Configure KDM for smart card

To configure KDM for smart card

  1. Run the following command:
    vastool smartcard configure pam kde

Unlike GDM, KDM presents both a Username: and a Password: prompt simultaneously to the user. You can not change these prompts. The prompt-vassc-user and prompt-vassc-pin options in the [pam_vas] section of vas.conf have no effect.

Note that KDM displays additional information from the Authentication Services PAM module in a pop-up window, which only disappears when the user clicks OK. Thus, the prompt-style and show-token-status options are not recommended for KDM.

Disable remote login

To disable remote login

  1. Open the KDM configuration file for editing.

    Typically this file is located at /etc/X11/xdm/xdm-config or /usr/share/config/kdm/kdmrc on Redhat.

  2. Look for the [XDMCP] section and verify that the Enable property is either not present, commented out, or is set to false, like this:

    [XDMCP] Enable=false.

Use KDM with a smart card

To perform smart card login by means of K Display Manager (KDM)

  1. Insert your smart card.
  2. Enter your username or UPN at the Username: prompt.
  3. Enter your PIN at the Password: prompt.
  4. Click the Login button.

KDM calls the pam_vas_smartcard module to perform the authentication.

Note: KDM displays the Username: and Password: prompts regardless of the presence or absence of the smart card in the reader. In addition, KDM does not allow you to enter an empty username. While GDM permits an unspecified username, KDM requires one. Failure to provide a username results in a "login failed" message.

Related Documents