|
Posted by Brian Komar \(MVP\) on April 3, 2008, 8:39 pm
If you were Registered and logged in, you could reply and use other advanced thread options
the NTAuth store does not contain root certs, it must contain the CA that
issued the smart card certificate
Look at the CA stores in the working forest using PKIView.msc (from the
resource kit).
They must be the same in the other forest.
Number 2, does CRL checking work in the other forest (are the URLs
accessible)/
Number 3. Do the accounts have the same UPN in both forests. The UPN in the
cert must match the account's UPN in the 2nd forest to work
Brian
> The SmartCards can log into on AD Forest, but not another. The two forest
> don't trust each other.
>
> Looked that the article on 3rd party CA's, but still no go. The 3rd party
> CA's root certificates are in the NTAuthCA store, and the CRLs have been
> imported into Certificate manager and placed in the CRL store.
>
> "Brian Komar (MVP)" wrote:
>
>> The domain controller certificate will work for smart card
>> authentication.
>> You meed to look at the KB article on enabling smart card auth certs from
>> 3rd paty CAs.
>> http://support.microsoft.com/kb/281245/en-us
>>
>> Does the certificate contain the user's UPN in the subject alternative
>> name
>> Is the CA in the NTAuth store
>> Are all CRLs and CA certificates for the 3rd party chain available
>>
>> Brian
>>
>> > Thanks for the response. I have read the articles, have a question.
>> >
>> > We have smartcards issued by a third party ca, and have the root-ca's
>> > certificate listed in the places mentioned in the articles. Our
>> > DomainController Certificate is not from the Same CA that issued the
>> > SmartCards Certificates. The Certificate is from our Enterprise CA.
>> > We
>> > are
>> > currently using the DomainController template, which doesn't list
>> > SmartCard
>> > Logon as a property.
>> >
>> > Does the DomainController's certificate contain the SmartCard Logon
>> > property? If so, How can I add the SmartCard Logon property to the
>> > DomainController Template or do I need to upgrade to Enterprise
>> > Edition?
>> >
>> > Don Jones
>> >
>> > "Dobromir Todorov" wrote:
>> >
>> >> Try this if you are looking at a third party (non-Microsoft) CA, or
>> >> Microsoft Standalone CA.
>> >>
>> >> http://support.microsoft.com/kb/281245
>> >>
>> >> If you are looking at your own, Microsoft Enterprise CAs, you'd
>> >> suggest
>> >> that
>> >> you go for a longer read here:
>> >>
http://technet2.microsoft.com/windowsserver/en/library/40c46d0e-f4a1-4b27-8b45-f09b448130ae1033.mspx?mfr=true
>> >>
>> >> --
>> >> ---
>> >> HTH,
>> >> Dobromir
>> >>
>> >> Visit http://www.iamechanics.com
>> >>
>> >> > Can someone direct me to some articles that explain how to configure
>> >> > AD
>> >> > for
>> >> > Smart Card Authentication? If read various articles and they were
>> >> > not
>> >> > clear
>> >> > as to what is required and how to implement smartcard
>> >> > authentication.
>> >> >
>> >> > If this isn't the correct group, please let me know what the correct
>> >> > group
>> >> > would be.
>> >> >
>> >> > Thanks.
>> >> >
>> >> > Don Jones
>> >>
>> >>
>> >>
>>
>>
| 
XML site map