Bug 1035017

Description of problem:
Trying to login to desktop without a smart card shows blank screen when configured with smart card only option. 

Version-Release number of selected component (if applicable):
pam_pkcs11-0.6.2-10.el7.x86_64

How reproducible:


Steps to Reproduce:
1. System authentication on this machine is
configured with userDatabase to LDAP server, kerberos support enabled, the
KDC information is provided and smart card support is enabled.


Use smart card: ON

Enforce smart card: ON

Log out behavior configured to: Ignore smart card removal

Login with smart card is successful.

# cat /etc/pam.d/smartcard-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        [success=ok ignore=2 default=die] pam_pkcs11.so wait_for_card card_only
auth        optional      pam_krb5.so use_first_pass no_subsequent_prompt
auth        sufficient    pam_permit.so
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok auth_err=ignore user_unknown=ignore ignore=ignore] pam_krb5.so
account     required      pam_permit.so

password    required      pam_pkcs11.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_oddjob_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_krb5.so

2. Try to login as a user without a smart card.

Actual results:
Upon entering user name a blank screen is shown. 

/var/log/messages has this:
Nov 26 12:47:14 dhcp129-98 gdm-smartcard]: argument card_only is not supported by this module
Nov 26 12:47:14 dhcp129-98 gdm-smartcard]: no suitable token available
Nov 26 12:47:14 dhcp129-98 gdm-smartcard]: argument card_only is not supported by this module
Nov 26 12:47:14 dhcp129-98 gdm-smartcard]: no suitable token available
Nov 26 12:47:16 dhcp129-98 kernel: [  376.483820] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.

Note: Inserting a smartcard on the blank screen does ask for pin and able to login.

Expected results:
A message to enter smart card for the user.

Swapping the arguments "wait_for_card card_only" to "card_only wait_for_card" does request to insert a smart card when user name is entered.

# cat /etc/pam.d/smartcard-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        [success=ok ignore=2 default=die] pam_pkcs11.so card_only wait_for_card
auth        optional      pam_krb5.so use_first_pass no_subsequent_prompt
auth        sufficient    pam_permit.so
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok auth_err=ignore user_unknown=ignore ignore=ignore] pam_krb5.so
account     required      pam_permit.so

password    required      pam_pkcs11.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_oddjob_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_krb5.so

Additional info:

<halfline_laptop> 1) pam_pkcs11 needs the patches that were in rhel6 moved to rhel7
<halfline_laptop> (or get rebased assuming the patches have been upstreamed)