Smart Card Authentication about authelia

[james-d-elliott]

How would Authelia communicate with the Smart Cards?

[lyzstrik]

@james-d-elliott smart card contains the certificate along with the private key. The user should install an OpenSC module on their PC to ensure proper recognition of the smart card. After that, during authentication, Authelia prompts the client for the certificate. The client selects the certificate from the card, enters their PIN code, and is then authenticated.

[james-d-elliott]

I think this could do with some links to documentation on the relevant libs and/or APIs that could be leveraged to prove it's possible in this scenario. In particular we'd need a javascript or web request based go library that retrieves the proof of possession so that we could use the go backend to verify it.

I'd also be interested in the proof method used with smart cards as I am not entirely familiar, assuming it's similar to WebAuthn where the smart cards private key is used to sign an opaque challenge. For this to be secure the how the proof is determined is really important, and we'd need to be able to supply this challenge from the backend.

[lyzstrik]

Okay, I will work on the possibility of integrating this with a Go module. If I succeed, I will get back to you to discuss how we could incorporate it into the Authelia project.

[BryanJacobs]

The easiest way to use a smart card for web authentication today is to put https://github.com/BryanJacobs/FIDO2Applet/ on the card and use it as a passkey.

The second-easiest way is to put a PIV applet on it and have it do TLS client authentication (mTLS) with a web server. If Authelia is acting as the web server it could capture the client certificate; if not, the web server itself could pass down a header.

Personally, I think FIDO2 is a better overall user experience than PIV, but PIV is more powerful in terms of centralized features (such as key revocation and delegated CAs).

I'm not sure what the compelling advantage for the user is here though, to be honest.

[james-d-elliott]

Yeah I think I agree with that. Rather than reinventing the wheel I think these options are very standard. If someone wants to implement a mTLS solution like this then we'd welcome it. An existing FR exists for Passkeys and they're likely to be added soon.

We do however appreciate the time invested in the suggestion. It's not easy when an idea is rejected, but I don't think this has a compelling reason to be implemented. This is however open for discussion.