search

OpenSC / OpenSC

Open source smart card tools and middleware. PKCS#11/MiniDriver/Tokend
https://github.com/OpenSC/OpenSC/wiki
GNU Lesser General Public License v2.1
2.57k stars 734 forks source link

Unable to get login to work on macOS Catalina (10.15.5) #2297

Closed jamesd09 closed 9 months ago

jamesd09 commented 3 years ago

Hi! I'm trying to achieve the login into macOS Catalina (10.15.5) using the virtual smart card architecture.

This is the configuration that we are using:

Use Case 1: On using the Apple's CTK, and default loginwindow mechanism as the authorization plugin, we are able to see a PIN dialog on the login screen. On providing the PIN and pressing "enter" we get login. This case is working for us.

Use Case 2: On disabling the CTK and enabling OpenSCToken, we do not see the PIN dialog and see the following errors in the OpenSC logs:

P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] pkcs15-syn.c:157:sc_pkcs15_bind_synthetic: trying din66291
P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] pkcs15-din-66291.c:203:sc_pkcs15emu_din_66291_init_ex: called
P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] card.c:844:sc_select_file: called; type=1, path=e828bd080fa000000167455349474e::
P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] apdu.c:546:sc_transmit_apdu: called
P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] card.c:473:sc_lock: called
P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] card.c:513:sc_lock: returning with: 0 (Success)
P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] apdu.c:513:sc_transmit: called
P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] apdu.c:363:sc_single_transmit: called
P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] apdu.c:370:sc_single_transmit: CLA:0, INS:A4, P1:4, P2:C, data(15) 0x700009b9e3b0
P:382; T:0x123145465495552 19:43:00.369 [cryptotokenkit] reader-cryptotokenkit.m:260:cryptotokenkit_transmit: called
P:382; T:0x123145465495552 19:43:00.370 [cryptotokenkit] reader-cryptotokenkit.m:267:cryptotokenkit_transmit: reader '/dev/null:0x8C7B(1)'
P:382; T:0x123145465495552 19:43:00.370 [cryptotokenkit] reader-cryptotokenkit.m:268:cryptotokenkit_transmit:
Outgoing APDU (20 bytes):
00 A4 04 0C 0F E8 28 BD 08 0F A0 00 00 01 67 45 ......(.......gE
53 49 47 4E                                     SIGN
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] reader-cryptotokenkit.m:291:cryptotokenkit_transmit:
Incoming APDU (2 bytes):
6D 00 m.
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] reader-cryptotokenkit.m:304:cryptotokenkit_transmit: returning with: 0 (Success)
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] apdu.c:382:sc_single_transmit: returning with: 0 (Success)
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] apdu.c:535:sc_transmit: returning with: 0 (Success)
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] card.c:523:sc_unlock: called
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] iso7816.c:128:iso7816_check_sw: Instruction code not supported or invalid
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] iso7816.c:581:iso7816_select_file: returning with: -1204 (Unsupported INS byte in APDU)
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] card.c:866:sc_select_file: 'SELECT' error: -1204 (Unsupported INS byte in APDU)
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] pkcs15-syn.c:157:sc_pkcs15_bind_synthetic: trying esteid2018
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] pkcs15-syn.c:157:sc_pkcs15_bind_synthetic: trying cardos
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] pkcs15-syn.c:166:sc_pkcs15_bind_synthetic: searching for 'emulate foo { ... }' blocks
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] pkcs15-syn.c:168:sc_pkcs15_bind_synthetic: Blocks: 0x7fe57742e800
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] **pkcs15-syn.c:191:sc_pkcs15_bind_synthetic: returning with: -1413 (Unsupported card)**
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] card.c:523:sc_unlock: called
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] reader-cryptotokenkit.m:240:cryptotokenkit_unlock: called
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] reader-cryptotokenkit.m:247:cryptotokenkit_unlock: returning with: 0 (Success)
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] pkcs15.c:1285:sc_pkcs15_bind: returning with: -1413 (Unsupported card)
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] /Users/travis/build/OpenSC/OpenSC/OpenSCToken/OpenSCToken/Token.m:109:-[OpenSCToken initWithSmartCard:AID:OpenSCDriver:error:]: **sc_pkcs15_bind: -1413 (Unsupported card)**
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] card.c:414:sc_disconnect_card: called
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] card.c:436:sc_disconnect_card: returning with: 0 (Success)
P:382; T:0x123145465495552 19:43:00.373 [cryptotokenkit] ctx.c:931:sc_release_context: called

Please let us know if we need to provide any additional information. Thanks!

rohanpinto commented 3 years ago

@vjardin - could you assist with the above ?

frankmorgner commented 3 years ago

6D 00 indicates that the java card simulator has some problem rather than the PIV applet. Are you sure that the applet is correctly loaded and installed? Is it possible to use the applet via pkcs11-tool --test --login?

Please note that it should also be possible to do the login without OpenSCToken with Apple's default CTK implementation for PIV cards.

jamesd09 commented 3 years ago

Hi @frankmorgner, thanks for assisting.

The output of pkcs11-tool --test --login is as follows:

Using slot 0 with a present token (0x0)
Logging in to "PIV_II".
Please enter User PIN: 
C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  MD5: OK
  SHA-1: OK
  RIPEMD160: OK
Signatures (currently only for RSA)
  testing key 0 (PIV AUTH key) 
  all 4 signature functions seem to work
  testing signature mechanisms:
    RSA-X-509: OK
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
    SHA256-RSA-PKCS: OK
Verify (currently only for RSA)
  testing key 0 (PIV AUTH key)
    RSA-X-509: OK
    RSA-PKCS: OK
    SHA1-RSA-PKCS: OK
    MD5-RSA-PKCS: OK
    RIPEMD160-RSA-PKCS: OK
Decryption (currently only for RSA)
  testing key 0 (PIV AUTH key)
    RSA-X-509: OK
    RSA-PKCS: OK
No errors

In the log posted above, the line card.c:866:sc_select_file: 'SELECT' error: -1204 (Unsupported INS byte in APDU) was quite bothersome. Not able to understand why would that fail on OpenSC ?

Also, my applet & Java card is working fine with CTK. We moved to OpenSC as we needed more control over how we handle the PIN dialog on the mac login screen. I have follow up queries if you could assist me with please:

Our main objective here is to bypass the user interaction on the PIN dialog that appears on the login screen when the card is inserted.

  1. Is the PIN prompt/dialog that appears on the macOS login screen handled by OpenSC in any way?
  2. Can the PIN prompt be handled at the level of a custom authorization plugin? Is any context field or callback reference available that can be used to pass/store the PIN programmatically at the level of a custom authorization plugin. The goal here is to avoid the user entering the PIN at all on the login screen when the virtual smartcard is inserted.
  3. If that is not the case and Apple handles the PIN prompt, is there any exposed API which can be used to engage the PIN prompt dialog or pass PIN programmatically?
frankmorgner commented 3 years ago

In the log posted above, the line card.c:866:sc_select_file: 'SELECT' error: -1204 (Unsupported INS byte in APDU) was quite bothersome. Not able to understand why would that fail on OpenSC ?

As said above, this indicates a problem with jCardSim (or whatever Java Card Environment you're using) in combination with your applet; in particular because the very same SELECT doesn't error when being used in PKCS#11 (did you compare the logs?).

Regarding the PIN prompt issue, please see https://github.com/frankmorgner/OpenSCToken/issues/30

frankmorgner commented 3 years ago

You may want to have a look at PAM modules on macOS, which should still work for interactive logon. I'm sure Apple also has some Swift/Obj C API for logon as well...

frankmorgner commented 1 year ago

Apple seems to have added support for persistent tokens, but I have nothing more than the official documantation.

frankmorgner commented 1 year ago

I used to trigger the smart card insertion with a different USB device (e.g. e mouse or a keyboard), this should then start the CTK driver, see http://frankmorgner.github.io/vsmartcard/virtualsmartcard/README.html#configuring-vpcd-on-mac-os-x