SCR CAC reader for Leopard

Tom:

Thanks. I will give it a shot. Strange that it works in XP.

Pete

TSClark3,

Thanks for the tip. I had been beating myself over the head for months because the reader flashes but the Keychain ignores it! I was of the line of thought that the root of the problem was the lack of a middleware and/or an upgrade from 10.5.1 to 10.5.2. After reading your post, I realized that I had changed my CAC card in February of this year. The new one is an Oberthur. When I took a couple of coworkers newer cards which are Gemalto, the Keychain immediately recognized them. They still have an issue getting Safari to prompt with the PIN login but that will have to wait for another day. Thanks for the reminder that the simplest things are sometimes the most effective!

I can’t get OS X to ‘see’ the card. Now what?

Using VMWare to BootCamp running Windows XP I connect with no problem to Ft. Monmouth email and the AKO portal using the CAC. The problem would seem to be a combination of the Oberthur v5.2 CAC Card the SCR 3310v2 card reader and OS X LEOPARD 10.5.5. When I reboot and leave VMWare off I should be able to use the card in OS X. Not happening.

With OS X, initially, the light never came on. First I downloaded and installed the Card drivers available from: http://www.scmmicro.com/support/pcs_downloads.php?lang=en (Driver/Firmware... SCR331/SCR531 CCID USB... MacOS X). The green light blinks once on the reader. Console output says:
“9/12/08 12:28:24 PM com.apple.SecurityServer[19] Notice Loading scmccid 5.0.6.”

Still nothing in Keychain. Then I downloaded and installed libusb, re-booting. No change, nothing in Keychain.

The card reader is recognized but not the CAC. Am I reading this right? When I execute ‘pcsctest’ OS X “sees” the reader but not the card. ‘pcstest responds with:
$ pcsctest
MUSCLE PC/SC Lite Test Program
Testing SCardEstablishContext : Command successful.
Testing SCardGetStatusChange
Please insert a working reader : Command successful.
Testing SCardListReaders : Command successful.
Reader 01: SCR3310 Smart Card Reader 00 00
Enter the reader number : 1

Waiting for card insertion : Command successful.
Testing SCardConnect : Card is unresponsive.

“Card is unresponsive?” Now what?

====================================

The following is a description of my environment:
Hardware Overview:
Model Name: MacBook Pro 15"
Model Identifier: MacBookPro1,1
Processor Name: Intel Core Duo
Processor Speed: 2 GHz
Number Of Processors: 1
Total Number Of Cores: 2
L2 Cache: 2 MB
Memory: 2 GB
Bus Speed: 667 MHz
Boot ROM Version: MBP11.0055.B08
SMC Version: 1.2f10
Sudden Motion Sensor:
State: Enabled

Reader:
Scr3310 v2.0 smart OS® Powered
s/n 21120744228938
p/n 904887

CAC Card:
Oberthur v5.2

The SCR3310 card reader for DoD CAC still remains a significant problem for end users. I have taken the step to use the System Profiler which recognizes the card reader. Additionally, and perhaps unnecessarily, I've downloaded the SCM driver for the reader but the KeyChain does not indicate any indication of its presents. The pcsctest seems to interact with the card reader and gives the below response. First attempt the card is responsive but subsequent use of the pcsctest results indicate the card is unresponsive. Hope this did not kill my CAC. Seems the KeyChain under Leopard is not configured to read from the SCR3310. Is there a solution? Anyone help please.

System Profiler indicates the following:
SCR3310 USB Smart Card Reader:

Version: 5.18
Bus Power (mA): 500
Speed: Up to 12 Mb/sec
Manufacturer: SCM Microsystems Inc.
Product ID: 0x5116
Serial Number: 21120747241640
Vendor ID: 0x04e6

Pscstest results:
Macintosh:testct32_v1.0.2 Steve$ pcsctest

MUSCLE PC/SC Lite Test Program

Testing SCardEstablishContext : Command successful.
Testing SCardGetStatusChange
Please insert a working reader : Command successful.
Testing SCardListReaders : Command successful.
Reader 01: SCR3310 Smart Card Reader 00 00
Enter the reader number : 1

Waiting for card insertion
: Command successful.
Testing SCardConnect : Command successful.
Testing SCardStatus : Command successful.
Current Reader Name : SCR3310 Smart Card Reader 00 00
Current Reader State : 34
Current Reader Protocol : 0
Current Reader ATR Size : 21
Current Reader ATR Value : 3B DB 96 00 80 1F 03 00 31 C0 64 77 E3 03 00 82 90 00 C1 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Testing SCardDisconnect : Command successful.
Testing SCardReleaseContext : Command successful.

PC/SC Test Completed Successfully !
Macintosh:testct32_v1.0.2 Steve$

Pcsctest subsequent attempt response:

Macintosh:testct32_v1.0.2 Steve$ pcsctestMUSCLE PC/SC Lite Test Program

Testing SCardEstablishContext : Command successful.
Testing SCardGetStatusChange
Please insert a working reader : Command successful.
Testing SCardListReaders : Command successful.
Reader 01: SCR3310 Smart Card Reader 00 00
Enter the reader number : 1

Waiting for card insertion
: Command successful.
Testing SCardConnect : Card is unresponsive.
Macintosh:testct32_v1.0.2 Steve$

I spent this morning trying Oberthur and Non-Oberthur cards with a 17" MacBook Pro 2.4 running 10.5.5.

All of the Non-Oberthur cards showed up in Keychains and worked with Safari for DOD web mail access.

None of the Oberthur cards showed up in Keychains using multiple readers. However, both the Oberthur and Non-Oberthur cards worked with the same readers in Windows XP under Parallels.

A visual examination of the Oberthur and Non-Oberthur cards shows a difference in the contact pads. The Oberthur cards have 3 vertical contacts on the right side of the pad. The Non-Oberthur cards, Gemplus, have only 2 extended vertical contacts on the right side of the pad. Significance of this is unknown.

However, it appears that Oberthur card stock should be avoided.

The SCR3310 card reader works fine with "Gemplus" made CACs. I have tried half a dozen "Gemplus" made CACs with no issues, but "Oberthur" made CACs don't show up in the Keychain.

Great thread; very helpful. I was able to get my CAC working and was able to access my AF OWA account. I still have no luck with AF Portal. Has anyone cracked the code to gain CAC access to the AF Portal?

I appear to have the same issue with an Oberthur card & SCR3310 (the only reader sold at the PX).
pcsctool gives me four options for "token drivers":
1. GSCISPlugin.bundle
2. commonAccessCard.bundle
3. mscMuscleCard.bundle
4. slbCryptoflex.bundle

for all of which, pcsctest reports:

MUSCLE PC/SC Lite Test Program

Testing SCardEstablishContext : Command successful.
Testing SCardGetStatusChange
Please insert a working reader : Command successful.
Testing SCardListReaders : Command successful.
Reader 01: CCID Smart Card Reader 00 00
Enter the reader number : 1

Waiting for card insertion
: Command successful.
Testing SCardConnect : Command successful.
Testing SCardStatus : Command successful.
Current Reader Name : CCID Smart Card Reader 00 00
Current Reader State : 34
Current Reader Protocol : 1
Current Reader ATR Size : 21
Current Reader ATR Value : 3B <snip> 00
Testing SCardDisconnect : Command successful.
Testing SCardReleaseContext : Command successful.

PC/SC Test Completed Successfully !

but I've noticed in /var/log/security.log, each time the card is inserted/accessed:

com.apple.SecurityServer[19]: token in reader CCID Smart Card Reader 00 00 cannot be used (error 229)

the light on the reader is steady, but blinks when pcsctest is running... I suppose this means the card isn't being read properly.

Who is PSD? I supposed it depends on the post, but will I have any issues requested a replacement for an otherwise working CAC?

I've read all of the threads on this post, and I'm running into a new wall that hasn't been addressed yet. I've followed the steps in your post and I get the following error: "An error has occured. Unable to add an item to the current keychain. The specified item already exists in the keychain."

Any thoughts? Could this be a 10.5.5 issue?

In order to unlock that type in the X509Anchors, just as it shows on your keychain, case sens.

I posted an email to a vendor of the SCR 331 CAC reader. A sales rep responded saying that the SCR 331 requires middleware, which is suppose to be available in January or February 2009. Until then the reader will not recognize the card (using 10.5.5 that is). So, if I receive word back from the sales rep and learn that there is middleware available I will repost...

OK folks - great news! OS X 10.5.6 has CAC support. With this new update, I was able to access my government email. Some things to remember:

- You may have to put "/" at end of URLs that you add in "Location or Email Address" when you select New Identity Presence.
- "Quit" Keychain to save what you've done
- Clear out Safari cache, "Quit" it and restart it

I can't believe Apple finally put this back into OS X! Awesome.

After update to 10.5.6, I verified that the SCR3310 card reader now works fine with "Oberthur" made CACs. "Oberthur" made CACs now show up in the Keychain.

My SCR3310 was working great w/ 10.5.5, but now w/ 10.5.6 it is inop! When I plug it in to the Macbook, the green light flashes once for a split second, then nothing. Nothing when I insert the CAC, nothing appears in Keychain, however in System Profiler it is listed.

I've tried installing the drivers from the SCM site...NADA!!!!

I am experiencing the same issues here. My SCM 3310 worked perfectly on 10.5.5 but the recent update to 10.5.6 now makes me SCM 3310 CAC Reader totally unrecognizable (brief green light when I plug-in but then dead - does not even show up in keychain anymore).

Working from the Apple post at http://lists.apple.com/archives/Fed-talk/2008/Dec/msg00093.html provided NO SOLUTION. My reader's firmware is the newest version from SCM and per msg00093 (and the attached link to Open Source author's CCID supported CAC Readers - http://pcsclite.alioth.debian.org/ccid.html) specifically states that SCM 3310 is suported.

Apple support is requested on this item as it has impacted nearly a dozen DoD Mac users at my station (which makes it hard to sing the praises of Mac when every update seems to cripple usability). I hate to revert to 10.5.5 and ignore all future OS X updated but MUST be able to use my CAC at home. If anyone has solved this issue please post the steps to fix the matter; any help is appreciated.

V/r
Matt