HP ActivCard Smart Card Guida rapida

Implementation of an ActivCard® smart card solution on HP CCI

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

Reference hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

Configuration compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Software configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Step 1: Configuring a Certificate Authentication (CA) service . . . . . . . . . . . . . . . . . . . . . . .4

Step 2: Group policy setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9

Step 3: HP blade PC middleware configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10

Step 4: Client smart card driver configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10

Smart card setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11

Initialization of the smart card using Microsoft Remote Desktop Connection . . . . . . . . . . . .11

Initialization of the smart card using HP Session Allocation Manager Client (HPSAM Client) .14

Requesting a certificate from the blade PC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Usage cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19

Usage case 1: User authentication from client device to blade PC using RDP . . . . . . . . . . .19

Usage case 2: User authentication from client device to blade PC using HPSAM client . . . .19

Usage case 3: Accessing secure Web site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20

Usage case 4: User authentication using VPN through firewall to blade PC . . . . . . . . . . . . 21

Additional information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

This white paper discusses the implementation of ActivCard® smart cards on HP Consolidated Client

Infrastructure (CCI). This white paper is not intended as a comprehensive overview of ActivCard smart

card technology.

NOTE: The images and instructions in this white paper use Microsoft Windows XPe; however, HP also

tested procedures using Microsoft XP Professional and Microsoft Windows CE.NET.

NOTE: The images in this white paper were created using ActivClient™. For information about ActivCard

Gold™, see the ActivCard Gold user guide.

Introduction

Smart cards can provide additional security to a CCI implementation. This paper describes a smart card

reference implementation that you can use in a dynamic or a static CCI environment.

Prerequisites

This white paper assumes that the reader is familiar with CCI and has a working knowledge of Microsoft

Group Policies, Microsoft Certificate Authentication (CA), and setting up smart card readers and middle-

ware.

Reference hardware and software

The following list provides the reference hardware and software used to validate the CCI product with a

smart card:

•Load Balancer.

• HP Server running F5 networks BigIP version 4.6.4.

• HP Server running HP Session Allocation Manager version 1.0.

•Primary Domain Controller.

• HP server running Microsoft Windows Enterprise 2003 Server SP1. Configured as DNS,

DHCP, IIS, CA, and secure Web site server.

•VPN Tunnel.

•Altiris Deployment Server.

•Network Switch.

•HPProcurve2626.

•Blade Enclosure.

• HP e-class blade enclosure.

•Blade PCs

• HP bc1000 blade PC running Microsoft Windows XP SP2 w/HPSAM blade service installed.

• HP bc1500 blade PC running Microsoft Windows XP SP2 w/HPSAM blade service installed.

•Clients

• HP Compaq t5000 series thin client running Microsoft Windows XPe w/HPSAM blade ser-

vice installed.

• HP Compaq t5000 series thin client running Microsoft Windows CE w/HPSAM blade ser-

vice installed.

• HP desktop PC running Microsoft Windows XP w/HPSAM blade service installed.

•Smart Card Readers

• HP standard USB Smart Card Keyboard.

Driver: HPKBCCID.sys, version 4.28.0.1.

• USB CAC approved smart card reader (SCM Microsystems SCR331 Reader).

Driver: SCR33X2K.sys, version 4.27.00.01.

• Serial CAC approved smart card reader (SCM Microsystems SCR131 Reader).

• USB Combo Fingerprint & Smart Card reader (SCM Microsystems SPR337).

Driver: spr337.sys, version 1.16.00.01.

•ActivCard middleware

• ActivCard ActivClient v5.4.

• ActivCard Gold v2.2.

Configuration compatibility

HP has tested the following configurations using ActivCard ActivClient v5.4, ActivCard Gold v2.2 and

confirmed that the configurations work in a CCI environment.

HP USB Smart Card

Keyboard

SCM Microsystems

SCR331 USB Reader

USB Reader SCM

Microsystems

SCR131 Serial

Reader

Serial Reader SCM

Microsystems

SPR337 USB Combo

Reader

HPThinClientw/XPeXXXX

HP Thin Client w/CE.net X X X

HPDesktopw/XPProXXXX

Software configuration

Configure the following items to set up a smart card solution on CCI:

1. Certificate Authentication (CA) service

2. Group policy settings

3. Middleware running on a HP blade PC

4. Smart card client driver

Step 1: Configuring a Certificate Authentication (CA) service

Configure a CA service. This white paper uses Microsoft Certificate Services to configure certificates.

Detailed instructions for installing a CA service is beyond the scope of this white paper. For more informa-

tion about installing Certificate Services, see http://www.microsoft.com/technet/security/smallbusi-

ness/prodtech/windowsserver2003/build_ent_root_ca.mspx and http://h20000.www2.hp.com/bc/

docs/support/SupportManual/c00363517/c00363517.pdf.

After you install the CA service, perform the following configuration steps:

1. Create an MMC with the following snap-ins:

• Active Directory Users and Computers

• Certification Authority

• Certificate Templates

2. Click Certificate Templates and look for the Smartcard Logon certificate in the right pane.

3. Create a duplicate template by right-clicking on the Smartcard Logon certificate template, and then

selecting Duplicate Template.

4. Type a name for the new template in the Template display name box. This example uses CCI

Smartcard Logon.

5. Click the Request Handling tab.

6. Select or type 1024 in the Minimum key size box.

7. Click the CSPs button.

8. Select Requests can use any CSP available on subject's computer.

9. Click the Security tab.

10. In the Permissions for Authenticated Users box, in the Allow column, select Read and

Enroll.

You have completed creation of the template.

11. Copy the CCI Smartcard Logon certificate template into the Certificate Templates folder under the cer-

tificate server.

a) Expand the Certification Authority object in the MMC you created in step 1.

b) Expand your CA name.

c) Right-click on the Certificate Templates folder under the CA server.

d) Select New > Certificate Template to Issue.

12. Select the template, and then click OK to import the template.

Step 2: Group policy setting

Apply the following smart card group policy settings to the computer through a user policy setting or

through a computer policy setting:

•Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options - Inter-

active Logon: Require smart card, enable or disable. The default is disabled

•Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options - Inter-

active Logon: Smart card removal behavior, no action or lock workstation or force logoff. The default

is no action.

Step 3: HP blade PC middleware configuration

The following provides HP blade PC software configuration:

•For the purposes of this white paper, an HP CCI implementation with the hardware and software

components listed in “Reference hardware and software” on page 2 was used.

•Install one of the following ActivCard middleware packages on the HP Blade PCs:

• ActivCard ActivClient v5.4

• ActivCard Gold v2.2

Step 4: Client smart card driver configuration

Configure thin client software (XPe and CE). Detailed instructions for installing drivers on an XPe or CE

image is beyond the scope of this white paper. You can find instructions for XPe at http://

h200001.www2.hp.com/bc/docs/support/SupportManual/c00264469/c00264469.pdf and instruc-

tions for CE http://h200001.www2.hp.com/bc/docs/support/SupportManual/c00234778/

c00234778.pdf.

>> Install the appropriate driver from the list below for the device that you will use.

• HP standard USB Smart Card Keyboard

Driver: HPKBCCID.sys, version 4.28.0.1

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali HP Software

HP OmniBook 2100 Manuale utente

HP StorageWorks 2/140 - Director Switch Manuale di istruzioni

HP Integrity BL860c Manuale di servizio

HP Surestore Disk Array 12h - And FC60 Manuale utente

HP Brocade BladeSystem 4/12 Manuale utente

HP Surestore Disk Array 12h - And FC60 Manuale di riferimento

HP C7791C - DesignJet 130 Color Inkjet Printer Guida alla configurazione

HP Blade Blade Manuale utente

HP Integrity BL860c Manuale utente

HP BB118BV - StorageWorks Data Protector Express... Manuale utente

HP PROLIANT 56976839 Come usare

HP Media Center m1000 - Desktop PC Guida rapida

HP Vectra E-Vectra Guida di riferimento rapido

HP Bc1500 - BladeSystem - Blade PC Manuale utente

HP HP-UX 11i Manuale di servizio

HP ProLiant DL320e Manuale utente

HP ProBook 6445b - Notebook PC Manuale utente

HP t5300 - Thin Client Manuale utente

HP Pavilion w1000 - Desktop PC Manuale operativo

HP Surestore Tape Library Model 10/180 Manuale utente

HP StorageWorks 2/16 - SAN Switch Manuale di istruzioni

HP C7791C - DesignJet 130 Color Inkjet Printer Guida alla configurazione

HP BL30p - ProLiant - 1 GB RAM Manuale utente

HP NC373m - PCI Express Dual Port Multifunction Gigabit Server... Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

Novell

Novell SP2 - S Manuale di istruzioni