Seamless Smartcard SSO login for Messaging Gateway

Products

• Messaging Gateway

Issue/Introduction

Administrators using Smartcards for Messaging Gateway (SMG) Control Center login may observe that the process is not seamless. After PIN entry, the system requires a manual username entry and selection of the "Logon with Smartcard" checkbox. This article explains how to achieve a seamless Single Sign-On (SSO) experience.

Symptoms

• User selects Smartcard certificate and enters PIN.
• The SMG landing page still requires the username to be typed.
• The "Logon with Smartcard" box must be manually checked.

Environment

• Symantec Messaging Gateway 10.9.0 and higher.
• Smartcard/CAC/PIV infrastructure.

Cause

In the native SMG Smartcard authentication flow, user identity information is not automatically utilized to bypass the login form. 

Resolution

To achieve a seamless (SSO) login flow, utilize a third-party Identity Provider (IdP) to handle the Smartcard authentication via OpenID Connect (OIDC).

1. Configure an OIDC provider within the Messaging Gateway Control Center (version 10.9.0+).
2. Set up the Smartcard/Certificate authentication policy at the 3rd party identity provider level.
3. When administrators access the SMG URL, they are redirected to the identity provider.
4. The identity provider performs the certificate/PIN validation and passes the authenticated identity back to SMG via the OIDC token.
5. This offloads the identity extraction to the IdP, resulting in a seamless transition into the SMG Control Center.

Additional Information

More information about OIDC use in Messaging Gateway is available in the Messaging Gateway's product documentation:

About OpenID Connect Authentication