Configure PIV smart card authentication
This article lists the configuration required on the Director Server and in Active Directory to enable the smart card authentication feature.
Note: Smart card authentication is supported only for users from the same Active Directory domain.
Director server configuration
Perform the following configuration steps on the Director server:
-
Install and enable the Client Certificate Mapping Authentication. Follow the Client Certificate Mapping authentication using Active Directory instructions in the Microsoft document, Client Certificate Mapping Authentication.
-
Disable Forms Authentication on the Director site.
Start IIS Manager.
Go to Sites > Default Web Site > Director.
Select Authentication.
Right-click Forms Authentication, and select Disable.
-
Configure the Director URL for the more secure https protocol (instead of http) for client certificate authentication.
-
Start IIS Manager.
-
Go to Sites > Default Web Site > Director.
-
Select SSL Settings.
-
Select Require SSL and Client certificates > Require.
-
-
Update web.config. Open the web.config file (available in c:\inetpub\wwwroot\Director) using a text editor.
Under the <system.webServer> parent element, add the following snippet as the first child element:
<defaultDocument>
<files>
<add value="LogOn.aspx"/>
</files>
</defaultDocument>
Active Directory configuration
By default, Director application runs with the Application Pool identity property. Smart card authentication requires delegation for which the Director application identity must have Trusted Computing Base (TCB) privileges on the service host.
Citrix recommends that, you create a separate service account for Application Pool identity. Create the service account and assign TCB privileges as per the instructions in the Microsoft article, Protocol Transition with Constrained Delegation Technical Supplement.
Assign the newly created service account to the Director application pool. The following figure shows the properties dialog of a sample service account, Domain Pool.
Configure the following services for this account:
- Delivery Controller: HOST, http
- Director: HOST, http
- Active Directory: GC, LDAP
To do this,
-
In the user account properties dialog, click Add.
-
In the Add Services dialog, click Users or Computers.
-
Select the Delivery Controller hostname.
-
From the Available services list, select HOST and http Service Type.
Similarly, add Service Types for Director and Active Directory hosts.
Firefox browser configuration
To use the Firefox browser, install the PIV driver available at OpenSC 0.17.0. For installation and configuration instructions, see Installing OpenSC PKCS#11 Module in Firefox, Step by Step. For information on the usage of the smart card authentication feature in Director, see the Use Director with PIV based smart card authentication section in the Director article.