471 questions
SmartCard Authentication
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(99.2, 47%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKW%3C/text%3E%3C/svg%3E)
Krista Whipple
1
Reputation point
Linux smart card authentication works with Chrome on the same system; however, Microsoft Teams app is unable to prompt for a smart card pin. MST uses the same .pki/nssdb store that Chrome uses (as I would expect since it's using a chrome sandbox), so it reads the card and installed CA certs. Is there an option that Teams can be started with to allow it to prompt for a smart card pin?
Microsoft 365 and Office | Skype for Business | Linux
Microsoft Security | Microsoft Entra | Microsoft Entra ID
25,080 questions
{count} votes
-
Sharon Zhao-MSFT 25,756 Reputation points Microsoft External Staff2021-09-16T09:11:40.517+00:00 Does anyone else have the same the problem?
To determine if this is a smart card side problem, please try to enable Multi-Factor Authentication in Teams for Linux and observe the result.
-
Krista Whipple 1 Reputation point
2021-09-16T15:21:04.21+00:00 I've been through the limited settings in the Linux Teams client and there's no mention of two-factor authentication. Can you tell me where I can enable that? Also, to clarify, when I use the Teams browser app in Chrome on Linux, it asks me for my pin and logs me in successfully.
-
Sharon Zhao-MSFT 25,756 Reputation points Microsoft External Staff
2021-09-17T06:36:52.943+00:00 Please pay attention to Turn on Modern authentication for your organization part in this article.
Besides, we are trying to verify this. If there is any update, I will share with you as soon as possible.
Thanks for your patience and understanding.
-
Krista Whipple 1 Reputation point
2021-09-17T08:37:39.513+00:00 The issue is not on the organization's side of the infrastructure (which I do not have access to manage). I can login into Teams with my smart card if I use Teams in a Chrome browser on Linux - authentication works perfectly in this situation. When I attempt to use the Teams Linux application, however; is when the functionality breaks. From what I can tell by digging through the files contained in the RPM and DEB packages, the MST application is using a standalone Chrome Sandbox and ElectronJS. Due to the nature of the OpenSC library on linux, I believe the sandbox isolation allows for the application to read the smart card, but does not allow it to initiate the PIN input box necessary to unlock the smart card. If I am not mistaken, the smart card PIN input form in Linux is a window-manager function and not a function of Chrome. If this is the case, it explains why it works in the Chrome browser, but the native MST application.
-
Sharon Zhao-MSFT 25,756 Reputation points Microsoft External Staff
2021-09-21T13:16:05.92+00:00 I don't get any update of this problem now. But your words make sense.
I will update the process here as soon as possible.
Have a good day!
-
Sharon Zhao-MSFT 25,756 Reputation points Microsoft External Staff
2021-09-24T08:35:50.363+00:00 After resaerching, this problem is more related to authentication, not the normal use of Microsoft Teams. I will add azure-ad-authentication tag for this thread. Someone checking this tag will give you more insights.
Thanks for your patience and understanding.
Sign in to comment
Sign in to answer