Freerdp: NLA+Smartcard. Still need to provide /u and /p?

[macredash]

So, maybe this is a limitation of freerdp or maybe this is a limitation in my understanding of the parameters. I am trying to connect to a Windows host using a smartcard. Once the connection is established, I get the remote login screen and I can log in with the card certificate. However, I am still prompted at the command line to provide a username and password prior to that (apparently due to NLA?). Enabling username and password login on the Windows host defeats the purpose of requiring smartcard credentials and disabling NLA is not an option for me.

Is freerdp capable of doing smartcard only authentication to establish the connection?

[HenryJacques]

@macredash No smartcard logon "directly" with NLA is not supported at all with FreeRDP.

For my knowledge: what are your smartcard vendor and model? I suppose you're using the Windows Base CSP (not a PKCS11 library)?
Thanks

[macredash]

OK, thank you for the response. So, am I correct in my understanding that the username and password prompt is to establish the initial NLA "protected" connection? If NLA were disabled on the server side would it skip the u/p prompts?

We use a variety of Gemalto and Safenet cards with Omnikey card readers. And no, the Windows environment we are connecting to does not use the Windows base CSP. They use some sort of third party PKCS11 library.

R/

[ondrejholy]

@macredash AFAIK It is as you said, username/password is needed by NLA in order to establish the secure connection with the server. Authentication just only using smartcards seems to work correctly without NLA, e.g. with -sec-nla option.

However RDP protocol seems to support smartcard authentication also with NLA, it just hasn't been implemented yet in FreeRDP. TSCredentials struct should contain TSSmartCardCreds instead of TSPasswordCreds, see:
https://msdn.microsoft.com/en-us/library/cc226784.aspx

[Barsug]

It will be very cool to implement this feature "TSSmartCardCreds" for NLA. Can it be implemented?

[kb1ooo]

Is this possible via +password-is-pin? I'm not sure how to get it to work though. The following doesn't work for me:

 xfreerdp +password-is-pin /smartcard /u:smartcard_username /v:host

Thanks,
Marc

[macredash]

I dont think that changes the problem. +password-is-pin is just another way of getting/passing the pin input. The problem still remains that the main branch of freerdp is not able to use smartcard credentials for NLA authentication -- last I checked anyways.

That being said I recently came accross a custom build that claims to do so... https://github.com/dodo040/FreeRDP-smartcardlogon

I have not had time to test this. I would love to see this capability rolled into the main branch.

[dbungert]

The problem of smartcard + NLA is obtaining the container string. I have not been able to locate a cross-card method of reading that value. TSSmartCardCreds doesn't help unless you have the container string so that the server knows what cert you're talking about.

[akallabeth]

5195 tries to implement that. Currently not ready to be merged, would require someone to fix it up.

[martinl]

I set up a bounty for adding RDP smartcard authentication with NLA support (details in https://github.com/FreeRDP/FreeRDP/issues/4709) and I can help with testing