Network token with CryptoTokenKit

As documentation states

"Tokens are physical devices that can be built in to the system, located on attached hardware (like a smart card), or accessible through a network connection"

We'd like to make token that would acquire 

TKTokenKeychainContents
(certificates) through network(without smart card reader).

What's would be the best approach for this ?

What should we set for com.apple.ctk.token-type in Info.plist ?

The only possible value i found is "smartcard".

I have not found any documentation regarding other options.

The only extension target that Xcode gives is "Smart Card Token Extension"

Up vote post of ElenaS Down vote post of ElenaS
6k views
Posted by
ElenaS
Reply
Add a Comment

Replies

Can you please explain what is the actual reason behind the below error -

[client] Unable to connect to tokenServer even after retries. (ep=(null) uid=(null))

Some more information I got from system log -

2021-03-09 00:26:09.036130+0530 localhost ctkd[469]: <ctkd> [com.apple.CryptoTokenKit:tokenhost] Failed to communicate with driver (null), error: Error Domain=NSCocoaErrorDomain Code=4099 "The connection on anonymousListener or serviceListener from pid 21919 was invalidated." UserInfo={NSDebugDescription=The connection on anonymousListener or serviceListener from pid 21919 was invalidated.}
2021-03-09 00:26:09.036225+0530 localhost ctkd[469]: <ctkd> [com.apple.CryptoTokenKit:tokenhost] failed to acquire token from extension myTokenExtension, error:Error Domain=NSCocoaErrorDomain Code=4099 "The connection on anonymousListener or serviceListener from pid 21919 was invalidated." UserInfo={NSDebugDescription=The connection on anonymousListener or serviceListener from pid 21919 was invalidated.}
2021-03-09 00:26:09.036497+0530 localhost TokenShow[21975]: (CryptoTokenKit) <CryptoTokenKit`-[TKClientToken ensureConnectionWithError:]> [com.apple.CryptoTokenKit:client] reconnecting ctkd after invalidate, try 3


I get this intermittently when I unload the token by calling the removeTokenConfiguration and then again load it using addTokenConfiguration.

I have a requirement where I want to frequently call remove and add token configuration to sync keys and certificate to CTK multiple times, each time I would want to sync different set of keys+certificates.

Also, is there a way to make the keys+certificates/identities available to login or system keychain using CTK extension?
Posted by
anshuman_mor
Up vote reply of anshuman_mor Down vote reply of anshuman_mor
Add a Comment