The Smart Card authentication component provides the pam_sm_authenticate(3PAM) function to verify the identity of a smart card user.

The pam_sm_authenticate() function collects as user input the PIN number. It passes this data back to its underlying layer, OCF, to perform PIN verification. If verification is successful, the module returns PAM_SUCCESS, and passes the username and password from the smart card to PAM modules stacked below.pam_smartcard.

The following options can be passed to the Smart Card service module:

debug

sysolg(3c) debugging information at LOG_DEBUG level.

nowarn

Turn off warning messages.

verbose

Turn on verbose authentication failure reporting to the user.

The PAM smart card module (pam_smartcard) can be configured in the PAM configuration file (/etc/pam.conf). For example, the following configuration on on the desktop (Common Desktop Environment) forces a user to use a smart card for logging in.

The following are typical values set by 'smartcard -c enable', if the command is applied to the default configuration.

dtlogin         auth requisite          pam_smartcard.so.1
dtlogin         auth required           pam_authtok_get.so.1
dtlogin         auth required           pam_dhkeys.so.1
dtlogin         auth required           pam_unix_auth.so.1
 
dtsession       auth requisite          pam_smartcard.so.1 
dtsession       auth required           pam_authtok_get.so.1 
dtsession       auth required           pam_dhkeys.so.1 
dtsession       auth required           pam_unix_auth.so.1