Windows Desktop Access - AD CS Mandatory ? Smardcard Logon Issue in no AD CS environment

[vngu95]

AD CS is mandatory for Teleport SmartCard Authentication to Windows Server ?

https://goteleport.com/docs/desktop-access/active-directory-manual/

It seem AD CS prerequisite is only for LDAPS and Teleport have already a PKI CA itself for Certificate user generation and smardcard authentication.

We have already PKI but not Microsoft AD CS.

LDAPS working well on our Domain Controller with certificate generated from our no-Microsoft PKI CA.

I run successfully Powershell script for:

• Create a restrictive service account
• Create the CDP/Teleport container.
• Gives Teleport the ability to create LDAP containers in the CDP container.
• Gives Teleport the ability to create and delete cRLDistributionPoint objects in the CDP/Teleport container.
• Gives Teleport the ability to write the certificateRevocationList property in the CDP/Teleport container.
• Gives Teleport the ability to create and delete certificationAuthority objects in the NTAuthCertificates container.
• Gives Teleport the ability to write the cACertificate property in the NTAuthCertificates container.
• Publish the Teleport CA to the NTAuth Store and Active Directory Domain
• Enable the Smart Card service

Configuration Teleport service done succesfully, the resources were imported sucessfully from discovery AD to Teleport Web Console.

Then we have error at connection in Windows logon:
Sign in with SmartCard isn't supported for your account.

EventLog:
Kerberos Event:
The Kerberos Key Distribution Center (KDC) for the domain ***** does not have a certificate installed or does not support logon using certificates: 0xC0000320

Security Event:
Additional Information:
Ticket Options: 0x40810010
Failure Code: 0x10
Pre-Authentication Type: 15

[zmb3]

No, AD CS is not strictly required. This error likely indicates that your KDC certs do not have the appropriate EKU for smart card login.

[vngu95]

See EKU in certificate in my Lab Domain Controller:

Below the options used in inf file for CSR request for generate certificate Domain Controller to my PKI External No-ADCS:

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=**.." ;<- dns domain controler name
KeySpec = 1
KeyLength = 4096
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
HashAlgorithm = SHA256
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xA0
[RequestAttributes]

[EnhancedKeyUsageExtension]
OID=1.3.6.1.4.1.311.20.2.2 ; Smart Card Logon
OID=1.3.6.1.5.5.7.3.1 ; Server Authentication
OID=1.3.6.1.5.5.7.3.2 ; Client Authentication
OID=1.3.6.1.5.2.3.5 ; KDC Authentication

; End File

v3extention file:
keyUsage=digitalSignature,keyEncipherment
extendedKeyUsage=clientAuth,serverAuth,msSmartcardLogin
subjectKeyIdentifier=hash

Anyone have the procedure or example for Windows Destop Access in no ADCS environment ?

[zmb3]

This can be pretty tricky to get right. The best and most complete reference I'm aware of is https://awakecoding.com/posts/active-directory-kerberos-kdc-certificate-selection/

A couple highlights to look out for:

• The issuer CA cert must be present in the NTAuth store
• Revocation checks must succeed
• The certificates are imported in the correct order so that the proper KDC cert is selected (this is the tricky part)

[patshining]

I configured the certificate with openssl. LDAPS ok but unable to connect with KDC and smartcard logon.

options ssl openss.cnf

[ req ]
default_bits       = 4096
distinguished_name = req_distinguished_name
x509_extensions    = v3_req
prompt             = no

[ req_distinguished_name ]
commonName=srvdc01.domain.lan

[ v3_req ]
basicConstraints=CA:FALSE
keyUsage=digitalSignature, keyEncipherment
extendedKeyUsage=serverAuth, clientAuth, 1.3.6.1.5.2.3.5, 1.3.6.1.4.1.311.20.2.2 
subjectAltName=@alt_names

[ alt_names ]
DNS.1=srvdc01.domain.lan
DNS.2=domain.lan
DNS.3=DOMAIN