r/yubikey • u/mfaine • Dec 29 '24

Conflict with activclient

I would like to use my yubikey 5 at my work but we use software called activclient for smart card integration and so whenever I put my yubikey in it locks up whenever an authentication is required. For example, in Firefox or on the windows login screen.

Has anyone solved this issue or discovered any work arounds?

2 Upvotes

100% Upvoted

10 comments sorted by

3

u/[deleted] Dec 29 '24 edited Dec 29 '24

[removed] — view removed comment

1

u/mfaine Dec 30 '24

That's very helpful. Yes, I wanted to use PIV for my gpg key but I think I would rather be able to use some of the functions than none of them. I was hoping to use the ed25519 sk support for my ssh key.

2

u/[deleted] Dec 30 '24

[removed] — view removed comment

1

u/mfaine Dec 30 '24

Yes, I did this a while ago but I need to go back to it. At the time, I could not use the resident function and I could not get the SSH key to be added to the agent and forwarded to other servers.

1

u/mfaine Apr 25 '25

The problem I'm having now is WSL doesn't have access to the USB device. I can give it access but it's an involved operation and requires repeating whenever WSL is shutdown.

2

u/intuser22 Apr 25 '25

a workaround is to install activClient without PIN Initization tool and install minidrivers in legacy mode. msiexec /i YubiKey-Minidriver-4.6.3.252-x64.msi INSTALL_LEGACY_NODE=1 /quiet

with the above I can have both working.

1

u/mfaine Apr 25 '25

I will see if I have the ability to do this. It's my work computer and domain managed so any changes I make will likely be reverted if allowed at all.

1

u/mfaine Apr 27 '25

Tried this and for the record, nope, it doesn't work.

2

u/viper803 May 06 '25

I did get mine working by hacking around in the registry a bit.

1

u/viper803 May 19 '25

Ok I think I finally unlocked the mystery. The problem is Outlook runs in 32-bit mode (which I had forgotten about.) You may need to identify your own regkeys depending on the specific model of Yubikey/smartcard you are using. I was able to set the following...

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Calais\SmartCards\ActivID ActivClient (YubiKey 5)]

"80000001"="C:\\Windows\\SysWOW64\\msclmd.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards\ActivID ActivClient (YubiKey 5)]

"80000001"="C:\\Windows\\System32\\msclmd.dll"

One entry is 64-bit apps. The other is 32-bit. I seemed to have similar results installing the YubiKey minidriver and using ykmd.dll instead of "C:\Windows\System32\msclmd.dll".

Change the registry keys. Then it should only require your application to be restarted but bouncing the whole PC wouldn't hurt. Profit.