We are going to change admin logons to yubikey/PIV (certifikate).
Right now we have to set “Do not use any credentials” and logon using the windows logon window. using smartcard redirect.
RoyalTS should be able to setup the standard logon to smartcard and just ask for the pin/Fingerprint from the yubikey, when loggin on
Thanks for the suggestion. RDP smart card / PIV logon is a bit different from username/password logon.
With the Microsoft RDP control, which Royal TS uses on Windows, the supported API mainly allows us to enable smart card redirection. The actual smart card credential selection and PIN/fingerprint prompt are handled by Windows/RDP/CredSSP itself. We currently do not have a reliable public API from the Microsoft RDP ActiveX control that lets us simply set “use smart card as the standard logon credential” in the same way we can set username/password credentials.
That is why the currently recommended setup is to enable smart card redirection and avoid sending stored credentials, so that the Windows logon / credential UI can perform the smart card authentication.
FreeRDP has support for smart card logon and exposes a callback to choose from the smart card certificates it detected. However, it does not provide a ready-made API that lets us configure “use certificate X” in a product-level setting and have FreeRDP automatically select it for every connection. You could ask the guys at the FreeRDP project if this is even possible.
So the short answer is: smart card redirection is supported; automatic “smart card as the configured credential type, prompt only for PIN/fingerprint” is not something we can currently confirm as generally supported through the Microsoft RDP ActiveX API.