feat: system-provided smart card support for macOS

[TheBestTvarynka]

Hi,

This PR adds system-provided smart card support for macOS. This implementation should also work on Linux and Windows, but dev-testing has shown that we have a bug in the WinSCard layer (something related to the scars cache, but needs further investigation).

See more details in the following intermediate PRs:

• feat: implement system-provided smart card credentials handling #483
• feat(sspi): implement data sigining using scard #491
• refactor(sspi): small conditional compilation refactoring #493
• fix(ffi): accept regular credentials for smart card logon #494

Configuration

You should configure the following environment variables before trying to connect:

name	value	meaning
SSPI_PKCS11_MODULE_PATH	<path/to/pkcs11 module>	sspi-rs will resolve this module in runtime and use it for communicating with the smart card
SSPI_KDC_URL	<KCD URL>	This variable can be omitted if DNS is configured
SSPI_LOG_LEVEL	trace	You can set any log level you want
SSPI_LOG_PATH	<path/to/logfile>	Any file path
SSPI_SCARD_TYPE	system	This variable can be either system or emulated
WINSCARD_USE_SYSTEM_SCARD	true	Enables system-provided scards. Set to false to use an emulated smart card. This is needed for our WinSCard module.
WINSCARD_SMARTCARD_CONTAINER_NAME	<container name>	It is needed for scare cache initialization
WINSCARD_CERTIFICATE_FILE_PATH	<path/to/smartcard/certificate>	It is needed for scare cache initialization. Alternatively, the WINSCARD_CERTIFICATE_FILE_DATA variable can be set with base64-encoded certificate data

Example

./sdl-freerdp /v:DESKTOP-QELPR32.tbt.com /u:t2 /d:tbt.com /p:123456 /smartcard-logon /sec:nla /cert:ignore /log-level:TRACE /auth-pkg-list:\!ntlm,kerberos /sspi-module:/Users/user/Documents/projects/sspi-rs/target/debug/libsspi.dylib /kerberos:pkcs11-module:"/usr/local/lib/libykcs11.2.7.2.dylib" /winscard-module:/Users/user/Documents/projects/sspi-rs/target/debug/libsspi.dylib > rdp.out.log

[CBenoit]

FYI: I’m waiting on devops to fix a permission problem before merging, hopefully okay in not too long!

[TheBestTvarynka]

I’m waiting on devops to fix a permission problem

@CBenoit any updates? 🙃

[CBenoit]

LGTM!