Signed Applet to Access Smart Card Reader

I am trying to develop an applet that will access a smart card on the client's side. The applet will need to load the PKCS#11 library(.dll) from the client side.
What is the most secure way to implement this design?
1 solution I am think of is to use Java Web Start which will download the applet onto the client desktop. Is this the right way?
Is there a solution where the applet can run in the browser and access the smart card without downloading the applet?
Thanks.

This is a duplicate of this and is probably better dealt with in the WebStart forum. I'm locking this thread.

Similar Messages

Access to smart card reader on Win 8.1 RDP Host

Hi,
I have a customer that has a couple of Windows 8.1 Pro computers, that has a smart card reader in the local keyboard.
Until a few months ago, they could RDP to the desktop computer from a RDP client such as another Windows PC, a Mac or a mobile device.
The problem is now that when accessing the desktop computer (with the smart card reader keyboard) from a RDP client, the smart card reader is not available in the RDP session anymore. This prevents them from logging on to an application in the network that
requires their smart card.
Can someone perhaps point me in a direction where this can be solved, either with the MS RDP host or with some 3rd party RDP host applications?
(Teamviewer or similar remote support applications works, but that is not what the customer want...)
Since it worked like a charm up until 2-3 months ago, there must have been some update to Win 8.1 that prevents this by default?
Thanks in advance,
/Mikael Forslund

Hi Mikael Forslund,
I am supposing you attempted to use smart card reader connected directly to Remote Desktop terminal. Basically your RDP session should redirected smart card reader to the client side and will not see readers connected to the host side
because enable Safety equipment such like smart card reader will cause highly insecure and that is not by design.
We suggest using smart card reader on local RDP client for your issue.
“The reverse is also true; if you RDP into a session from the start you will never see any local smartcard readers as Winscard will detect it’s running in an RDP session and no calls to Winscard will ever reach the local PC/SC layer –
everything will be redirected to the connecting client.”
Quote from this TechNet article
http://blogs.technet.com/b/instan/archive/2011/03/27/why-can-t-i-see-my-local-smartcard-readers-when-i-connect-via-rdp.aspx
Similar case has been posted and for your reference
https://social.technet.microsoft.com/Forums/windowsserver/en-US/47972083-b9bd-49fd-8708-b296af81bda3/usb-smart-card-reader-and-smart-card-connected-directly-to-remote-desktop-server?forum=winserverTS
Regards
D. Wu

MS Remote Desktop and smart card reader

I have installed MS Remote Desktop Conn. on my iMac and connected a smart card reader via the USB. Although my reader energizes when the computer is on, the computer doesn't seem to recognize the reader. When I insert a CAC card into the reader and try to log in remotely, I continue to get a "username/password" box instead of the CAC PIN number. Do I need to install some kind of smart card driver or does Apple already have it? I'm at a loss as to how to fix this.

I was able to get rdesktop 1.6.0 to install on my Mac and I was able to get CAC log-in to work.
However, the installation is a little tricky. I downloaded rdesktop 1.6.0 from this link:
<<http://www.rdesktop.org>>
My instructions for installation:
1. Make sure Xcode Tools is installed on your computer. It should be on your OS X install disk.
2. Find out where your X11 libraries are located:
-From the Finder menu, selct "Go" >> "Go to Folder..."
-Type (without the quotes) "/usr/X11", and click "Go"
You should see a bunch of folders. Make sure the "include" and "lib" folders are there. Otherwise you need to find out where the X11 "include" and "lib" folders are located on your computer.
3. Download rdesktop and place the (unarchived) rdesktop-1.6.0 folder on your Desktop
4. Open the X11 application (should be in your Utilities folder)
5. In the X11 window type the following (without the quotes):
"cd Desktop/rdesktop-1.6.0 && ./configure --enable-smartcard -x-includes=/usr/X11/include -x-libraries=/usr/X11/lib && make && sudo make install"
4. Hit enter. When prompted, enter your administrator password and hit enter.
rdesktop should now be installed in the following folder:
/usr/local/bin
So, to launch rdesktop with smartcard log in enabled, open the X11 application (or Terminal application) and type the following (without the quotes, and replace your.server.address with the server address):
"cd /usr/local/bin && ./rdesktop -r scard your.server.address"
Hit enter and it should launch a new X11 window that will try to access the remote server where you should be prompted for your PIN.
To explore more options with rdesktop, open X11 and type the following (without quotes):
"cd /usr/local/bin && ./rdesktop"
Hit enter and you should get a list of options available to rdesktop.

NIGHTMARE! Signed Applet - No Access. Please Help.

Hi:
I'm trying to make a signed applet gain access to my directory structure.
I created a simple applet to test with one line:
sErr = System.getProperty("user.dir");
The code is below.
I sign it using the following:
keytool -genkey -keyalg rsa -storepass MyCerts
As you can see I'm using the default keystore but I've tried it by using -keystore MyKeystore too.
It runs me through all the questions which I answer, no problems.
Then I sign it:
jarsigner -signedjar SSignedApplet.jar SignedApplet.jar MyCerts
It asks for the passwords which I enter.
It completes without error and the SSignedApplet.jar file shows up in the directory.
If I open the signed jar file it has all 3 of the files in the META-INF folder and the Manifest file looks right to me.
I upload the jar and the Default.asp file to a Web server (I've tried localhost and a remote host).
I open the page and the pop up comes up asking if I want to trust the unverified applet. I click 'Run'.
Once the applet is 'Started' I click the 'Get Properties' button and I get the error:
access denied (java.util.PropertyPermission user.dir read)
I've tried 2 examples that work fine on my machine (that I didn't write).
The first is by Francois Orsini (Derby Demo) and the other is by Laura MacDougal (successfully wrote a file to my user.dir directory).
No matter what I do, I can't sign an applet and make it access anything.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en-US">
<head>
<script language="JavaScript" type="text/javascript">

</script>
</head>
<body bgcolor="#ffffff" style="margin:0px auto;width:800px;padding:0px">
<form name="fmLogin" action="" method="POST">
<table width="650" align="center" cellpadding="0" cellspacing="0">
     <tr>
          <td>Login</td>
          <td><input name="Login"></td>
     </tr>
     <tr>
          <td>Password</td>
          <td><input name="Password"></td>
     </tr>
     <tr>
          <td colspan="2"><input type="button" onclick="getProp();" value="Get Property"></td>
     </tr>
</table>
</form>
<APPLET CODE="SignedApplet.SampleApplet.class" WIDTH=1 HEIGHT=1 NAME="SampleApplet" ARCHIVE="SSignedApplet.jar"></APPLET>
</body>
</html>
package SignedApplet;
import java.applet.*;
import java.io.*;
import java.util.*;
public class SampleApplet extends java.applet.Applet {
    public String sErr = "";
    public void init() {
        // TODO start asynchronous download of heavy resources
    public void getProp()
        try
            sErr = System.getProperty("user.dir");
        catch(Exception exp)
            sErr = exp.getMessage();
    // TODO overwrite start(), stop() and destroy() methods
}

Thank you for reading my reply in your other thread:
http://forum.java.sun.com/thread.jspa?threadID=762212&messageID=4368224#4368224
If you've really run through it you would have known that code called from
javascript is not trusted and you have to use doprivileged (hey its in bold...
why would that be?).
Call getProp from init within the applet and you've got no problem.
As for your imageIcon, creating one with string as a parameter
the string is used as input for a File. I had no problem loading one with a signed applet.
I'll post the example later in your other thread.

T61/X61 integrated smart card reader

Hi,
Does anyone know if the optional smart card reader on the T61/X61 laptops are based on PCMCIA or Expresscard standards, what is the exact make and model, and if they are CCID compliant?
Thanks.

http://shop.lenovo.com/SEUILibrary/controller/e/na/LenovoPortal/en_US/catalog.workflow:item.detail?GroupID=38&Code=41N3043
Add Smart Card security technology to ThinkPad notebook computers equipped with a 54-mm ExpressCard slot. The Gemplus ExpressCard Smart Card Reader from Lenovo offers an ideal interface between a portable computer and a smart card, to control access to databases or corporate computer networks. A smart card is a plastic card that contains personalized information. It's function can range from simple data storage to more advanced memory and processing capabilities. The Gemplus ExpressCard Smart Card Reader from Lenovo is reader hardware only and does not include blank smart cards or smart card management software.
Features and Benefits:
Reads and writes(1) to all ISO-7816 compatible smart cards.
Reader hardware connects to any ThinkPad equipped with a 54-mm ExpressCard slot.
Includes drivers for Microsoft Windows 2000 and Windows XP to help get you up and running quickly.
And it's backed by Lenovo's limited warranty with renowned Service and Support available from IBM.
(1) Although this reader can be used to access any ISO 7816-compliant Smart Card, Lenovo's primary intent is to enable ThinkPad customers to integrate a security authentication application of their choosing.
have a look it is an express card version built by Gemplus, not sure about the rest.
Message Edited by wjli2 on 06-25-2008 12:42 PM

Use of CAC enabled sites (Smart Card Reader)

Would anyone happen to know if the PlayBook would support the use of the BlackBerry Smart Card Reader 2?
I would love to be able to access my DoD sites that require my CAC login using the BlackBerry Sled and my PlayBook. Thank you for any assistance in this matter.
BB-Soldier

Ditto!!!
I have a SCR331 and I am not able to get 10.5 to recognize my CAC card.
I do believe Leopard is recognizing and using the SCR331 but the problem
lies in the CAC Card Driver. Here are the details :
Hardware : SCR331 USB with firmware 5.22
CAC Card : Oberthur ID One v5.2
System log when CAC card is inserted into 10.5:
Nov 9 06:16:09 angel com.apple.SecurityServer[20]: src/CCIDDriver/common/CCID.c (793): Protocol type of card (T=1) not supported by this driver for this type of reader (TPDU)
Nov 9 06:16:09 angel com.apple.SecurityServer[20]: src/CCIDDriver/common/CCID.c (795): An APDU-level reader should be used
Nov 9 06:16:09 angel com.apple.SecurityServer[20]: src/CCIDDriver/common/CCID.c (793): Protocol type of card (T=1) not supported by this driver for this type of reader (TPDU)
Nov 9 06:16:09 angel com.apple.SecurityServer[20]: src/CCIDDriver/common/CCID.c (795): An APDU-level reader should be used
Nov 9 06:16:10 angel com.apple.SecurityServer[20]: src/CCIDDriver/common/CCID.c (793): Protocol type of card (T=1) not supported by this driver for this type of reader (TPDU)
Nov 9 06:16:10 angel com.apple.SecurityServer[20]: src/CCIDDriver/common/CCID.c (795): An APDU-level reader should be used
Nov 9 06:16:10 angel com.apple.SecurityServer[20]: src/CCIDDriver/common/CCID.c (793): Protocol type of card (T=1) not supported by this driver for this type of reader (TPDU)
Nov 9 06:16:10 angel com.apple.SecurityServer[20]: src/CCIDDriver/common/CCID.c (795): An APDU-level reader should be used
Nov 9 06:21:26 angel com.apple.SecurityServer[20]: src/CCIDDriver/common/ifdhandler.c (554): GCCmdCardStatus failed
Nov 9 06:21:26 angel com.apple.SecurityServer[20]: src/CCIDDriver/USB/MacOSX/usbserial_mosx.c (974): ERR: Couldn't close device (e00002c0)
I hope Apple developers manage to fix this in put it in 10.5.1.
Thanks,
Mike Bender
Orlando, FL

Token and smart card reader are not detected on Mavericks if not plugged on a USB port during system boot

Well, both token and smart card reader are not detected on OS X 10.9 if not plugged on a USB port during system boot. So, if I am already working within the system and need to use my certificates I have to plug the token or smart card reader on a USB port and restart Mavericks.
Token is a GD Starsign and Smart Card Reader is a SCR3310 v2.
Thoughts?

SCS is a very good app, since I've read that Apple has discontinued support for PC/SC interfaces after the release of Mountain Lion.
(My previous installation was a Mavericks upgrade from Lion)
However, I don't know what and how to debug using Smart Card Services. Do you know any commands to use?
Apparently, the SC reader reports no issues: the LED is blinking blue when no smart card is present and becomes fixed blue when a smart card is inserted – according to the manuals, this shows that there is correct communication between the OS and the CCID reader.
I don't know what to do; I'm beginning to hypothesize it's a digital signer issue. In fact, my smart card only supports one application called File Protector (by Actalis) to officially sign digital documents. This application seems to have major difficulties in identifying the miniLector EVO.
The generic and ambiguous internal error comes when I try to manually identify the peripheral.
Athena CNS is one of the Italian smart cards and is automatically recognized and configured (so it's correct – no doubts about this), while "ACS ACR 38U-CCID 00 00" seems to be the real name of the miniLector.
(I'm assuming this because System Information also returns that the real manufacturer is ACS... bit4id is a re-brander)
However, when I click on it and then tap OK, it returns internal error.
As first attempt, I would try to completely erase&clean File Protector files to try a reinstall. Then, if this still doesn't work, I'd debug using the terminal.
So:
- Do you know any applications to 100% clean files created by an installer?
- Do you have in mind any solutions that I might have forgotten?
Thanks in advance from an OS X fan!

Smart Card Reader not showing correct certificates?

Running 10.5.6 with an SCR331, G4 desktop. I have been using entourage, smart card reader, and CAC successfully for quite some time.
My CAC was recently updated with new certificates. When I insert my card reader with CAC into my machine, the keychain (and Entourage) show the old certificates which aren't even on my CAC anymore. Obviously I can't get Entourage (or other websites) to work without being able to access the new certs.
I verified the CAC & reader were good by looking at it using a windows XP machine. The three new certificates were there.
I also used another Mac (lap top) to verify the certs. I inserted my reader into the lap top, and the keychain on that machine displayed the correct certificates.
I have tried several methods of rebuilding/replacing my keychain without success. Is there another token that needs to be cleared? Any help in letting access the new certificates would be very much appreciated.
Thanks,
Bob

If you did what a lot of people did you put your certs locally and you do not need to do this. Delete them from your keychain and just in cert your CAC. Then create a "IDPref" for the DoD site you are trying to access and you should be good to go. If you need help, I have written a good "How-to" on my webblog. Just do a search for "safari and CAC".
Jonathan
<Edited by Host>

Smart card reader refusing to work on OS X Mavericks

Hi,
I am the owner of a bit4id Minilector EVO, a little smart card reader (manufactured by ACS Advanced Card Systems) who I use to comply with the digital signatures required by the Italian law.
There is an official application to use the smart cards; however, I'm experiencing major issues with it.
Shortly:
- When I plug the bit4id smart card reader into the USB port of my MBP, the LED shows it is recognized; System Information also tells it has been fully implemented into OS X
- When I then insert the smart card, no issues are reported and the bit4id LED becomes fixed;
But, when I start the application to digitally sign, it tries to detect what cryptographic module I'm using. It detects the correct one but reports an «Internal error» halting the process.
I know there is an implementation of PCSC for OS X called PCSC-Lite, and that there is a terminal command to show if all is working properly.
Something like pcsc[something] .
Can you help me?
Thanks in advance,
Tyrexionibus

SCS is a very good app, since I've read that Apple has discontinued support for PC/SC interfaces after the release of Mountain Lion.
(My previous installation was a Mavericks upgrade from Lion)
However, I don't know what and how to debug using Smart Card Services. Do you know any commands to use?
Apparently, the SC reader reports no issues: the LED is blinking blue when no smart card is present and becomes fixed blue when a smart card is inserted – according to the manuals, this shows that there is correct communication between the OS and the CCID reader.
I don't know what to do; I'm beginning to hypothesize it's a digital signer issue. In fact, my smart card only supports one application called File Protector (by Actalis) to officially sign digital documents. This application seems to have major difficulties in identifying the miniLector EVO.
The generic and ambiguous internal error comes when I try to manually identify the peripheral.
Athena CNS is one of the Italian smart cards and is automatically recognized and configured (so it's correct – no doubts about this), while "ACS ACR 38U-CCID 00 00" seems to be the real name of the miniLector.
(I'm assuming this because System Information also returns that the real manufacturer is ACS... bit4id is a re-brander)
However, when I click on it and then tap OK, it returns internal error.
As first attempt, I would try to completely erase&clean File Protector files to try a reinstall. Then, if this still doesn't work, I'd debug using the terminal.
So:
- Do you know any applications to 100% clean files created by an installer?
- Do you have in mind any solutions that I might have forgotten?
Thanks in advance from an OS X fan!

Broadcom USB Smart Card reader not working

After upgrading my Vista Business SP2 (32-bit) to Windows 7 Ultimate RC (32-bit) my Broadcom USB smart card reader does not work any longer (Dell Latitude E6400 with built in smart card reader).
The newest available driver from dell support was already tested (Broadcom, driver date 09/23/2008, version 1.0.0.1, digitally signed WHQL, released by dell in March 09), but the device can not start (Error code 10) with Windows 7.
With the Microsoft WUDF Driver (Usbccid, driver date 06/21/2006, version 6.1.7100.0) the device starts but whenever I insert my smart card an additional device is detected (other device - smart card) but no driver found - Error message is: The drivers for this device are not installed. (Code 28).
What else can I try to get this reader working again (with vista sp2 the smart card reader was working fine with the broadcom driver)?

I have also an USB card reader that works fine on XP PCs but Win7 does not recognise it, can msft make a sd reader driver that works pls.
Hi
Sorry, but the way the industry works is that Microsoft develops Windows and Hardware manufacturers develop drivers for their products. Microsoft does maintain a complete division (MSDN) that is dedicated to assisting hardware and software manufacturers in developing their products for compatibility with Windows.
All of the drivers that are contained on the Windows installation disk and on Windows Update are placed there by the manufacturers of the devices. This is a service that Microsoft provides to help these manufacturers to distribute their drivers.
What you can do.
1. Check with the computer manufacturer for updated drivers for that device. This is your best source, since the computer manufacturer builds, tests, and sometimes develops their own, custom drivers to work with the hardware on their PCs.
2. Try to determine the name and manufacturer of the device using Device Manager and MSInfo32. Once this information is found, try to find that manufacturers website and look for the latest compatible drivers.
3. Check to see if there are any users forums on the PC manufacturers or device manufacturers websites. Ask there about any known issues with this particular hardware device or if the device is no longer supported.
4. If the drivers are found but are only available for previous versions of Windows, install the drivers using the Windows Compatibility Mode. HOW TO: Install a Hardware Device Driver using Compatibility Mode
Right now, we are in a unique situation since we are using an operating system that is still in the pre-release phase. Many hardware/software manufacturers will be ofrficially supporting their products for Windows 7 until after the General Availability date of October 22, 2009.
Hope this helps.
Thank You for using Windows 7
Ronnie Vernon MVP

ACR122U smart card reader not recognized after reboot...

I am new to POS Windows and have been working with wondows for ever. I was using ACR 122u contactless usb smart card reader with windows XP and communicating with it using java with no problems. Then our I changed the OS to windows Pos ready 2009 and we found out that USB card reader has to be unplugged and plugged back in after rebooting the computer. other than the OS everything else is identicle (driver, reader, java program, ect..). Can any one tell me what could cause this problem and what I can do to solve this.
I have cheked the device manager and under USB controllers it says that it is unrecognized deivice..I tried changing the reader, changing the port and(actually the reader is pluged in to a linksys external usb hub, but changing this to a internal port did not make any difference) tried chagning some settings in control panel.
1. I checked the power option of the root usb hub.
2. Changed the driver.cab to a normal driver.cab obtained from the normal xp version. Uninstall the driver and reinstall it.
So far this hasnt been working.
I hope someone could help me with this.
~Tharanga

After extensive tests with Win 7 Embedded and ACR122U, I can confirm the same problem. It seems that reader firmware hangs and the only way to recover is to unplug and plug again the reader. We shall repeat the tests with readers from other manufacturers.
For the tests, we use a Win7 Embedded Standard PC with an ACR122U connected. We installed and configured the ACS Monitor program to start automatically with windows. We made a small utility to restart the PC every minute and we placed it on the Startup directory.
Within the first 5-10 reboots, the reader fails and the ACS monitor program shows " No reader connected" and no reaction from the reader. If we shall unplug and plug the reader again to the USB port everything works fine again.
Kostas P.

Acrobat 9 does not recognize the smart card reader that work with other app. Can someone help me?

Hi to All,
Acrobat 9 (included in CS4 design premium) does not recognize the smart card reader. I have a smart card reader ACR38 smart card that works with all applications except Acrobat 9 pro. I tried to uninstall and reinstall it again, but when I try to insert the digital signature message is always the same, that does not find the Acrobat reader. Can someone help me?

Hi MartinR
Thank you for your reply, i have tried what you suggest, and it did not work, the i DVD opening title changed but not the embedded movie.
Perhaps it is a setting in Final Cut Express?
After capturing my footage, i open a new project then i convert all clips to anamorphic, to give me the letterbox effect, i have tried now with and without anamorphic.
In my canvas screen, the footage does not fill the square, even if i have not selected anamorphic, and fall well within the TV safe areas, but the only way to ill the canvas up is to crop it bigger, but still when i export it does not give me the full screen view.
Any ideas?

How to install a smart card reader.

I am trying to install a smart card reader for work. There are no prompts when connecting via USB or anything else.

There shouldn't be a prompt when you connect an empty card reader. Insert a memory card into it and it should appear on the Desktop.

What kind of driver do I need to use for HP Elitebook 8440p RICOH Smart Card Reader?

I'm using Arch linux x86_64 and need to install Smart Card Reader, but I can't find any drivers for it.
Best regards,
Taavi

What operating system is it? Are you sure you put the card in the correct way? [not trying to be mean here]

T450s -- Display, NGFF SSD, Smart Card Reader, and m.2 SSD slots

I'm looking to order a T450s and have a few questions about options when configuring the order:
1080 Display -- Does anyone know if the 1080 display (non-touch) is made by LG or AUO or someone else? There was extensive discussion about the T440s, and people got different brands and the AUO was the preferred brand.
16GB m.2 NGFF SSD -- If I remove this option, and want to add a 3rd party compatible NGFF SSD later, can I do this?
3rd m.2 SSD Slot -- The options are None, 3rd m.2 SSD slot, or Smart Card Reader. If I select the Smart Card Reader option, can I later remove the Smart Card Reader and use it as a 3rd m.2 SSD slot? Or, if I select 3rd m.2 SSD slot and later want to use it for a Smart Card Reader, can I buy a Smart Card Reader and plug it into the slot?

Lenovo uses different FHD diplays for the T450s: one by AU Optronics and the other by LG Display.
However, the T450s uses a different LG display than the T440s. The LG screen of the T450s ("
LP140WF3-SPD1") seems to be much better than the LG screen of the T440s.
If you remove the 16GB M.2 SSD option, you can add a M.2 SSD later.
If you have a device with two M.2 slots, you can't use a M.2 SSD and WWAN at the same time.
If you have a device with three M.2 slots, you can only use single-sided M.2 SSDs in the third M.2 slot.
Both the SmartCard reader and the third M.2 slot are attached to the mainboard via a flexible flat cable.
If you choose the SmartCard reader, the warranty might be lost if you want to use the third M.2 slot, because you have to replace some parts that aren't so-called CRUs (consumer replaceable units).

Signed Applet to Access Smart Card Reader

Similar Messages

Maybe you are looking for