|
Posted by Brian Komar on July 10, 2005, 11:32 pm
Please log in for more thread options
DaveW@discussions.microsoft.com says...
> I've a set of requirements that a customer has asked me to engineer a
> solution for... but need some advice.
>
> Users will have smartcards for storing multiple key pairs / certificates.
> They will have as a minimum, a user non-repudiation signing key & cert, a
> role (bit like a job title) non-repudiation signing key and cert and a
> smartcard logon key pair and cert.
>
> My question is... is the Windows SmartCard logon "intelligent" enough to
> select the correct authentication key pair (I'm sort of guessing that it can
> look in the certificates' key usage for a smartcard logon usage (OID?)).
>
> Any advice would be extremely welcome.
>
> Regards,
>
> Dave
>
No. The authentication certificate and key pair must be stored on Slot 0
of the smart card. If you want a user to have a "normal" logon
certificate and a "role" logon certificate, you will have to implement
two smart cards, one for each role.
You can have multiple certificates on a smart card. For example, you
could add:
- S/MIME signing
- S/MIME encryption
- Code Signing
- Document Signing
- Key Recovery
etc. Anything except EFS encryption and EFS recovery (which are not
supported on smart cards)
In the future, there are plans to allow multiple authentication certs on
a single smart card, but that would only be in the Longhorn time frame.
Brian
--
==
Brian Komar
MVP - Windows - Security
http://www.identit.ca/blogs/brian
| 
XML Sitemap