Bug 1159385

did you set up your smartcard configuration manually or by using the authentication settings panel (authconfig-gtk)?

what's the output of

# gsettings get org.gnome.login-screen enable-smartcard-authentication
# DCONF_PROFILE=gdm gsettings get org.gnome.login-screen enable-smartcard-authentication

can you attach /etc/pam.d/smartcard-auth /etc/pam.d/password-auth and /etc/pam.d/system-auth

?

First setup was via authconfig-gtk but its been slightly modified and is now handled via puppet. 

both gsettings commands returns 'true'.

Created attachment 952613 [details]
pam-files

attached smartcard-auth-ac, system-auth-ac and password-auth-ac

from the log on the sister bug, (bug 1159056 attachment 952614 [details]) I see this:

Oct 31 21:57:07 c20550.ad.smhi.se gnome-session[989]: (gnome-settings-daemon:1041): smartcard-plugin-WARNING **: Got potentially spurious smartcard event error: ffffe098.
Oct 31 21:57:07 c20550.ad.smhi.se gnome-session[989]: (gnome-settings-daemon:1041): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

gnome-settings-daemon is what listens for smartcard insertion events. It seems like it may have gotten into a confused state following a driver error.

Can you log in, pull out the smartcard, and then run

/usr/libexec/gnome-settings-daemon --replace --debug >& gsd.out

at terminal, insert the smartcard, and then attach gsd.out to this report?

We lock the screen on smartcard removal, and it does not seem to be possible to run gnome-settings-daemon from console. I changed the order in your instruction a little, hope its ok:
- logged in
- started gnome-settings-daemon in debug mode
- removed smartcard
- insert smartcard. 

See attached file for details

Created attachment 954024 [details]
gnome-settings-daemon --debug

Thanks for the logs.

So the g_object_unref is actually unrelated to smartcards:

(gnome-settings-daemon:4688): color-plugin-DEBUG: failed to enumerate directory /home/a001329/.color/icc: No such file or directory

(gnome-settings-daemon:4688): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

It's a bug in the color management plugin. I'll clone that as a separate report.

The spurious events are probably harmless too, since you only get 1 or 2, and we retry 10 times.

Actually, looking in the code this looks like a logic error in /usr/share/gnome-shell/js/gdm/util.js:

    _updateDefaultService: function() {
        if (this._settings.get_boolean(PASSWORD_AUTHENTICATION_KEY))
            this._defaultService = PASSWORD_SERVICE_NAME;
        else if (this.smartcardDetected)
            this._defaultService = SMARTCARD_SERVICE_NAME;
        else if (this._haveFingerprintReader)
            this._defaultService = FINGERPRINT_SERVICE_NAME;
    },

We only use the smartcard service if a smartcard is detected, but that's not correct.  We should use the smartcard service if password-authentication is disabled.

So really instead it should be: 

    _updateDefaultService: function() {
        if (this._settings.get_boolean(PASSWORD_AUTHENTICATION_KEY))
            this._defaultService = PASSWORD_SERVICE_NAME;
        else if (this._settings.get_boolean(SMARTCARD_AUTHENTICATION_KEY))
            this._defaultService = SMARTCARD_SERVICE_NAME;
        else if (this._haveFingerprintReader)
            this._defaultService = FINGERPRINT_SERVICE_NAME;
    },

Awesome, I changed the line in /usr/share/gnome-shell/js/gdm/util.js and it does indeed work as expected after this. I did however stumble upon another bug, but I filed this separate in #1160764

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0535.html