link smart card authentication server to active directory

1. Nothing should need to be integrated with AD as support for SC logon has been around natively since Win2k.  You may need to install drivers and middleware on the client, but AD should not be touched.

The closest you come to AD is if you wish to set GPO for SC related options such as require SC logon, and lock or logout user on SC removal.

2. This is standard behavior.  Many SC companies will require a GINA or (more typical) a GINA Stub.  This is a small DLL that plugs into the MSGINA.DLL aspect of winlogon.  This provides the ability to recognize that vendor's card if it isn't one of the very few that ship pre-builtin to windows, - most of which have been updated and are not longer generally available.

Without getting technical, you authenticate your logon certificate to which only you (the user) knows the PIN.  The user enters their PIN to authenticate to the SC and the SC will pass the logon certificate for authentication to the network.  Using a FIPS-140 level 2 smartcard will ensure that your private key is safe on the card.

3. There isn't such a thing as a 'smart card server', per se.  This process is handled by your DCs via Kerberos and will authenticate the certificate on the smartcard against your Certification Authority (CA) that issued the Smartcard Logon or Smartcard User certificate to the card.  

If you have a larger (say 10,000+ users) network - you might consider looking into a Card Management System (CMS) - not to be confused with a Customer Management System...  There are very few companies out there that make this type of product, and a bunch of resellers.  ActivIdentity ActivID, Intercede MyID, and MS ILM2 or CLM products are the main players.  Anyone else be very careful and see how long they have been around - it normally takes over 3-4 years to get one of these produced for basic functionality.  This can be used to enable features like securely managing unblocking codes (if your user blocks their card after say 10 concurrent failed attempts, they can re-enable it by answering security questions to unblock it and can do so say 5 times per token then it is permanently locked - this is a feature of some of the more advanced cards and is not typcially included in their standard product.  You can suspend and unsuspend cards and many other nifty things with a good CMS.  However - the authentication still occurs through AD - the CMS just provides a more friendly way of managing complex needs of an enterprise - the suspending a card is really suspending the certificate and will be passed to the CA behind the scenes, for an example.  The CMS itself should not directly handle any aspect directly for the windows logon process.

4. I'm not quite following you here.  As above, there isn't a SC server.  Is this just a server that you're logging into, like a website or a remote console like terminal services, citrix, etc.?  If so, a number of card vendors will support Citrix, TS, etc. but make sure you check first as a lot also don't.  I would recommend a pilot program (getting a small number of readers for testing for usually 10 users or so, before dishing out for 500 users for something that is buggy).

If you are looking to validate a server's SSL certificate - it should be issued from a trusted root CA and the trust is inherent from there.  If it was compromised you need to revoke that certificate and then the client will see that it was revoked when it checks the CA's Certificate Revocation List (CRL) which happens automatically.

The requirement for the card to be inserted all the time is easily controlled by GPO or local security policy on the local and/or remote box. More info:

http://www.ultimatewindowssecurity.com/Wiki/Interactivelogon-Smartcardremovalbehavior.ashx

http://technet.microsoft.com/en-us/library/cc776917.aspx




Long and short of it - Windows handles it.  You will probably need to install some middleware software from the SC vendor to be able to read their cards - this is normal.  Try to figure out what situations will require a smarcard logon instead of worrying about how it works.  For example - local logon for Windows XP & Vista; remote logon over RDP, TS, Citrix; VPN users; email signing and/or encryption; file encryption; so on.  Sometimes talking to a card vendor's sales person or sales engineer will result in a number of ways you can use your card that you didn't think of - just let them know you're interested in using cards and want to know more about what they can be used for.