To configure smart card redirection on a RHEL 8.x virtual machine (VM), install the libraries on which the feature depends, the root CA certificate to support the trusted authentication of smart cards, and the required PC/SC Lite library.

Prerequisites

Integrate a RHEL 8.x Virtual Machine with Active Directory for Smart Card Redirection

Procedure

  1. Install the required libraries. 
    yum install -y opensc pcsc-lite pcsc-lite-libs pcsc-lite-ccid nss-tools
  2. Enable the pcscd service. 
    systemctl enable pcscd
systemctl start pcscd
  3. Make sure that the /etc/sssd/sssd.conf configuration file contains the following lines, which enable smart card authentication. 
    [pam]
pam_cert_auth = True
  4. Copy the required CA certificate to /etc/sssd/pki/sssd_auth_ca_db.pem. 
    openssl x509 -inform der -in certificate.cer -out certificate.pem
cp certificate.pem /etc/sssd/pki/sssd_auth_ca_db.pem
  5. To verify the status of the smart card, run the following pkcs11-tool commands and confirm that they return the correct output. 
    pkcs11-tool -L

pkcs11-tool --login -O

pkcs11-tool --test --login
  6. Set up the PKCS11 module. 
    cp libcmP11.so /usr/lib64/
  7. Create the /usr/share/p11-kit/modules/libcmP11.module file. Add the following content to the file. 
    # This file describes how to load the opensc module
# See: http://p11-glue.freedesktop.org/doc/p11-kit/config.html
 
# This is a relative path, which means it will be loaded from
# the p11-kit default path which is usually $(libdir)/pkcs11.
# Doing it this way allows for packagers to package opensc for
# 32-bit and 64-bit and make them parallel installable
module: /usr/lib64/libcmP11.so
priority: 99
  8. Update PC/SC Lite to version 1.8.8. 
    yum install -y git flex autoconf automake libtool libudev-devel flex
git clone https://salsa.debian.org/rousseau/PCSC.git
cd PCSC
git checkout -b pcsc-1.8.8 1.8.8
./bootstrap
./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu 
     --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr 
     --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share 
     --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec 
     --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man 
     --infodir=/usr/share/info --disable-static --enable-usbdropdir=/usr/lib64/pcsc/drivers
make
make install
  9. Install the Horizon Agent package, with smart card redirection enabled. 
    sudo ./install_viewagent.sh -m yes
  10. Restart the virtual machine and log back in.