Single Sign On fails when using any smart card token and when the Drive Encryption 7.2 policy option 'Must match user name' is enabled

Technical Articles ID: KB89462
Last Modified: 2023-02-23 04:55:03 Etc/GMT

Environment

Drive Encryption (DE) 7.2.0, 7.2.1

For details of DE 7.x supported environments, see KB79422 - Supported platforms for Drive Encryption 7.x.

Summary

Background details for DE policy option Must match user name:

The Must match user name option makes sure that the Single Sign On (SSO) details are captured only when the DE username and Windows username match. This option makes sure that the SSO data captured is replayed for the user for which it was captured. When you select the Enable SSO option, the Must match user name option is also enabled by default.

Problem 1

SSO fails after clients are upgraded to 7.2.0 or 7.2.1.

The problem is seen only with users who have the following:

Any assigned smart card token
The DE policy option Must match user name enabled

Problem 2

Mfe.Epe.log on the client records the following error:

EPEPC_cp_provider::GetCredentialCount (34): auto_logon_with_default=False
EPEPC_cp_provider::GetCredentialCount (34): Size of SSO Serialization=508
+ is_guid_alias (37)
is_guid_alias (37): old_alias:
is_guid_alias (37): {60B78E88-EAD8-445C-9CFD-0B87F74EA6CD}
is_guid_alias (37): new_alias:
is_guid_alias (37): {8FD7E19C-3BF7-489B-A72C-846AB3678C96}
is_guid_alias (37): alias found but not matched
- is_guid_alias (37)
EPEPC_cp_provider::GetCredentialCount (34): Found the SSO provider with 3 credentials
EPEPC_cp_provider::GetCredentialCount (34): Success getting the credentials serialization
EPEPC_cp_provider::GetCredentialCount (34): SSO credential failed comparison
EPEPC_cp_provider::GetCredentialCount (34): Success getting the credentials serialization
EPEPC_cp_provider::GetCredentialCount (34): Credential's serialization matches the SSO credentials
EPEPC_cp_provider::GetCredentialCount (34): credential count = 4
EPEPC_cp_provider::GetCredentialCount (34): Auto log on FALSE with default = 2

Cause

The Must match user name DE policy option doesn't apply correctly when checking the smart card user against a preboot user.

When a user logs on with a smart card, the authentication package returned by the standard Microsoft smart card provider does not contain a username or domain name. Thus, DE can't perform any user mapping and can't check that the current user is the same as the preboot authentication (PBA) user.

Anyone logging on using a smart card token updates the current PBA user's SSO details with the smart card's details.

Solution

This issue is resolved in DE 7.2.2 (Build 7.2.2.14).

To review other DE known and resolved issues, see KB84502 - Drive Encryption 7.x Known Issues.

Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, go to the Product Downloads site.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround 1

Disable the DE policy option Must match user name on the SSO DE logon policy page.

Workaround 2

For systems where you must allow multiple users who use a password and a smart card to log on, disable the SSO DE logon policy page.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Single Sign On fails when using any smart card token and when the Drive Encryption 7.2 policy option 'Must match user name' is enabled

Environment

Summary

Problem 1

Problem 2

Cause

Solution

Workaround 1

Workaround 2

Affected Products

Languages:

Title

Title

Knowledge Center

Single Sign On fails when using any smart card token and when the Drive Encryption 7.2 policy option 'Must match user name' is enabled

Environment

Summary

Problem 1

Problem 2

Cause

Solution

Workaround 1

Workaround 2

Affected Products

Languages:

Choose your region

Title

Title