Logon to Windows Vista using smartcard and CertiID in a Windows 2008 environment.

Transcription

1 KB Logon to Windows Vista using smartcard and CertiID in a Windows 2008 environment. Creation date: 15/05/2009 Last Review: 02/06/2009 Revision number: 2 Document type: How To Security status: EXTERNAL Summary This document describes the steps to follow for a certificate based logon in Windows Vista with a Windows 2008 Certificate Server. Details The test environment. The test setup is as follows: o A Windows 2008 server installed as a domain controller with the following roles configured: DNS, IIS, and Certificate Services. CertiID must be installed on the server o A Windows Vista client machine configured as a member of the Windows 2008 domain with CertiID installed and the necessary drivers (DIGIPASS 860 or DIGIPASS Key1). Issue a Certificate template. First we need to issue a new Certificate template for the Smartcard Logon and/or Smartcard User (which comprises smartcard logon but can also do secure ) Go to the Certificate Authority in the administrative tools on the windows 2008 server: Page 1 of 13

2 Go to the Certificate Templates section for you Certificate Authority right click choose new Certificate Template to issue: Page 2 of 13

3 Choose Smartcard Logon and/or Smartcard User: Request a certificate. Next we will request a certificate and put it on the smartcard. Open the Certificates MMC by opening the run command and typing MMC: Add the Certificates Snap-in: Page 3 of 13

4 Choose my account: Go to personal all tasks request a new certificate: Page 4 of 13

5 Choose Smartcard Logon, click details and then properties: Go to the Private Key tab and choose Microsoft Base Smart Card Crypto provider which is preferred with Windows 2008 and Vista: When you click enroll, you might be asked to enter a PIN for the Smartcard. Whether a Pin is required or not depends on the configuration made with CertiID when initializing the smartcard: Page 5 of 13

6 Now the Certificate is written to the smartcard. You can check if the Certificate is put onto the smartcard by using the Digipass CertiID management application: Page 6 of 13

7 Test certificate based logon. Now you can test the logon on your Vista Machine for that user.!!! Important is to make sure that the windows firewall isn t enabled on the Vista machine because this will prevent the machine from contacting the Certificate Server to validate the certificate. Start your Windows Vista machine that is member of the domain. Once the machine is on the Ctrl-Alt-Del screen Insert the Smart Card, press Ctrl-Alt-Del and choose Switch user. There you choose Smartcard logon. Page 7 of 13

8 The logon procedure will continuous automatically using the Smartcard inserted in your pc and the certificate on that Smartcard. Issue certificates for other users. To issue certificates for other users you must first issue an enrollment agent certificate template, then enroll issue the certificate for the other user. 1. issue an enrollment agent certificate template Page 8 of 13

9 Choose enrollment agent Template: Enroll the certificate go to the Certificates MMC and request a new certificate: Page 9 of 13

10 Choose enrollment agent: 2. Enroll a certificate for another user Go to the certificate MMC and choose to enroll on behalf: Choose the enrollment agent certificate: Page 10 of 13

11 Select the enrollment agent and then choose the same options as you would for enrolling a certificate for the local user: Page 11 of 13

12 Choose the correct user to which the certificate will be assigned: Insert the smartcard: Page 12 of 13

13 If needed, enter the PIN: Now the Certificate is written to the smartcard. You can check if the Certificate is put onto the smartcard by using the Digipass CertiID management application. Page 13 of 13