Bug 3393

Summary: smart card single sign-on with AD for Windows 2008
Product: ThinLinc Reporter: Peter ├ůstrand <astrand@cendio.se>
Component: | rdesktop (deprecated)Assignee: Henrik Andersson <hean01@cendio.se>
Status: CLOSED FIXED QA Contact: Bugzilla mail exporter <bugzilla-qa@cendio.se>
Severity: Normal    
Priority: P2 CC: hean01@cendio.se
Version: 3.0.0Keywords: ossman_tester
Target Milestone: 4.1.0   
Hardware: PC   
OS: Unknown   
Acceptance Criteria:

Description From cendio 2010-01-07 13:03:34
Just for completeness. This is the continuation of bug 2743 but for Windows
2008. As bug 2743, the new Windows versions actually has support for accepting
the PIN over RDP. There's a flag in the TS_INFO_PACKET called
------- Comment #1 From cendio 2012-12-05 11:05:16 -------
*** Bug 4500 has been marked as a duplicate of this bug. ***
------- Comment #2 From cendio 2012-12-20 16:27:47 -------
A simple hack just adding the INFO_PASSWORD_IS_SC_PIN flag show this
works as expected...

Anything you pass in userfield is ignored and if more then 2 smartcards
is available user needs to select which to use. I only one card is available
it is used for SSO using pin from password argument.
------- Comment #3 From cendio 2012-12-20 17:35:13 -------
Upstream commit r1687 includes this flag for use.
------- Comment #4 From cendio 2013-01-07 09:21:07 -------
I have tried to send CN and subject as username to control what card to be used
for logon but it seem there is no way to control that. So if more then one card
is available for authentication SSO will not work and user need to select which
card to use.
------- Comment #5 From cendio 2013-01-07 11:19:03 -------
Vendordrop commit r26355
------- Comment #6 From cendio 2013-01-07 11:45:48 -------
Commit 26356 adds support for the new rdesktop argument to
pass pin as password to tl-run-rdesktop.

Briefly tested with and without card logon and it seems to work
as expected.
------- Comment #7 From cendio 2013-02-05 09:21:50 -------
Tester should verify the functionality, see comment #3 on bug #4498
for information about how to setup smartcard authentication for users
in Active Directory with thrid party CA / certificates.
------- Comment #8 From cendio 2013-03-18 12:58:51 -------
Upstream commit r1697 makes sure that CredSSP is not used when smartcard
SSO (pin as password) is used.
------- Comment #9 From cendio 2013-06-25 16:46:34 -------
Lightly tested and seems to work. Can't reliably do proper testing when our
backend Windows systems exhibit so unpredictable behaviour for smart card auth.