Centrify Express For Mac Smart Card

Posted on  by 

  • Most CACs are supported by the Smartcard Services package, however Oberthur ID One 128 v5.5 CACs are not. Third party middleware is available that will support these CACS; two such options are Thursby Software’s PKard and Centrify’s Express for Smart Card.
  • Centrify Express for Smart Cards implements Smart Card authentication on Mac OS X systems and supports all the essential capabilities users need to perform d.

You can also use the following third-party smart card drivers with CAC and PIV cards. N PKard for Mac v1.7 and v1.7.1 n Charismathics (CCSI5.0.3PIV) n Centrify Express To use a third-party smart card driver, you must disable the CryptoTokenKit smart card driver. For more information, see Disabling the CryptoTokenKit Smart Card Driver.

ActivClient for Mac | CACKey | Centrify Express | CSSI | High Sierra built in Smart Card ability | Mojave built in Smart Card ability | OpenSC | PKard | Sierra built in Smart Card ability | Smart Card Services / Files to manually remove | How to Unpair your smart card

Centrify Express For Mac Smart Card

Click the word GO at the top of your main desktop, select Computer

If you don't see the word GO, click Finder (2 little faces) in the bottom left corner of screen

Go to:

Hard disk / Library /

Delete 'CACKey' folder

Also follow this section to remove .tokend files

Run in Terminal.app:

sudo /usr/local/bin/opensc-uninstall

or

Go to:

Hard disk / Library /

Delete 'OpenSC' folder

Go to: Hard disk / Library / LaunchAgents /

Delete 'opensc-notify.plist'

Also follow this section to remove .tokend files

Go to:

Hard disk / Library / Application Support /

Centrify Express For Mac Smart Card

Delete 'CSSi' folder

Centrify Express For Mac Smart Card Processing

Also follow this section to remove .tokend files

Go to:

Hard disk / Library / Application Support / PKard

Run the PKard Uninstall program, select 'Uninstall PKard'

Centrify Express For Mac Smart Card Sign In

Click 'Uninstall'

You also need to modify a system file that Thursby changed. This does not happen automatically when running the Uninstall option listed above.

1. Remove your CAC from the reader

2. Open Terminal, by typing Terminal in the spotlight search

3. Copy the entire command below [starting with sudo, and ending with ~/] and paste it into the terminal window (or manually retype it)

sudo mv /Library/Preferences/com.apple.security.smartcard.plist ~/.Trash/

4. When prompted for your computer password, know that the cursor will not move, type it in, and hit enter to process.

5. Logout of Terminal,

6. Restart computer

Centrify express for mac smart card

Information provided from: https://www.thursby.com/forum/viewtopic.php?t=3394

Also follow this section to remove .tokend files

.

Go to:

Hard disk / Applications / Utilities / Centrify /

Double click: SmartCardTool or SmartCardAssist

Select 'Uninstall' from the Centrify Express for Smart Card window

Also follow this section to remove .tokend files

.

How to Remove ActivClient for Mac

Go to:

Hard disk / Applications / Utilities

Double click: ActivID ActivClient for Mac Uninstaller

Select 'Uninstall' from the ActivID ActivClient for Mac Uninstaller screen

ActivClient for Mac users must also remove the 'acpkcs220.dylib' file

Mac OS X 10.5.x - Mac OS X 10.10.x, 10.11.x - 10.15.x users look below

Go to:

Hard disk / System / Library / Security / tokend /

Delete 'BELPIC.tokend', 'CAC.tokend', 'CACNG.tokend', 'CSSI.tokend', 'OpenSC.tokend', 'JPKI.tokend', 'ac.ac4mac.token', 'PIV.tokend', and / or 'PKCS11.tokend' files

Sometimes a few other files need to be removed, they are found in:

Hard disk / System / Library / Security / tokend /uiplugins /

Delete 'BELPICViewerPlugin.bundle', 'CACViewerPlugin.bundle', and / or 'PIVViewerPlugin.bundle' files

NOTE: If you can't delete them, skip them and follow next step.

Mac OS X 10.11.x through 10.15.x systems

Go to:

Hard disk / Library / Security / tokend /

Delete 'BELPIC.tokend', 'CAC.tokend', 'CACNG.tokend', 'CSSI.tokend', 'OpenSC.tokend', 'JPKI.tokend', 'PIV.tokend', and / or 'PKCS11.tokend' files

Go to:

Hard disk / Library / Frameworks / ac.ac4mac.pkcs11.framework / Versions / Current / Libraries/

Delete 'acpkcs220.dylib'

DO NOT DISABLE on 10.15.x, there is NO alternative

NOTE: Mojave, High Sierra, and Sierra have a 'built in Smart Card ability' that works for 'some' people 'some' of the time. To use your CAC 'more consistently' I recommend you install a 3rd party CAC enabler, such as CACKey or PKard. This section shows you how to disable the built in smart card ability found on Mojave, High Sierra, and Sierra.


NOTE2: Doing this will remove the ability to login to your computer with your CAC, and will require you to install a 3rd party CAC enabler such as CACKey or PKard.

1. Remove your CAC from the reader

2. Open Terminal, by typing Terminal in the spotlight search

3. Copy the command below [starting with sudo, and ending with pivtoken] and paste it into the terminal window (or manually retype it)

sudo defaults write /Library/Preferences/com.apple.security.smartcard DisabledTokens -array com.apple.CryptoTokenKit.pivtoken

3a. I recommend you run this command twice.

4. When prompted for your computer password, know that the cursor will not move, type it in, and hit enter to process.

5. After that it should be disabled. Logout of Terminal, restart computer, and try again

NOTE3: If you have recently updated to Mac OS Catalina (10.15.x) or Mac OS Big Sur (11.00.x), you need to re-enable the built in Smart Card ability after removing all installed enablers listed above:

1. Remove your CAC from the reader

2. Open Terminal, by typing Terminal in the spotlight search

3. Copy the entire command below [starting with sudo, and ending with pivtoken] and paste it into the terminal window (or manually retype it)

sudo defaults write /Library/Preferences/com.apple.security.smartcard DisabledTokens -array && sudo defaults write /Library/Preferences/com.apple.security.smartcard EnabledTokens -array com.apple.CryptoTokenKit.pivtoken

3a. I recommend you run this command twice.

4. When prompted for your computer password, know that the cursor will not move, type it in, and hit enter to process.

5. After performing these steps, the built in smart card ability should be enabled.

6. Logout of Terminal,

7. Restart computer

8. When prompted to Pair your Smart Card with your computer, you can select Pair, or Cancel. If you elect to pair, you will have an additional option to utilize your CAC and PIN to access your computer [when the CAC is in the reader]. If the CAC is not in the reader, you can still use your fingerprint, or username/password option.

How to UNPAIR your smart card

1. Remove your CAC from the reader

2. Open Terminal, by typing Terminal in the spotlight search.

3. Type: sc_auth list

4. Copy the hash, which will be 40 characters comprising of numbers and letters, paste it in place of the [hash] in the command below

5. Type: sc_auth unpair -h [hash]

Instructions found at: https://support.yubico.com/support/solutions/articles/15000006468-using-your-yubikey-as-a-smart-card-in-macos

Coments are closed