Bug 1300421

Upstream ticket:
https://fedorahosted.org/sssd/ticket/2941

Sumit,

Please provide testing instructions.

In RHEL6 screen-locking after removing the Smartcard can be enabled by calling

    gconftool-2 --direct --config-source=xml:readwrite:/etc/gconf/gconf.xml.mandatory -s /desktop/gnome/peripherals/smartcard/removal_action lock_screen --type string

Restarting gdm should make sure that the new configuration is loaded.

Additionally please comment out the line containing pam_pkcs11 in /etc/pam.d/smartcard-auth and add
    auth        sufficient    pam_sss.so allow_missing_name
to the auth section in /etc/pam.d/smartcard-auth directly before or after the commented out pam_pkcs11 line.

After making changes as per comment 6 and comment 7, I did a reboot. I see that the screen locks when the smartcard is removed, when I move the mouse (card is still not inserted) it does not prompt to enter the specific smartcard. It prompts for the ipa user password.

[root@dhcp129-184 ~]# cat /etc/gconf/gconf.xml.mandatory/desktop/gnome/peripherals/smartcard/%gconf.xml
<?xml version="1.0"?>
<gconf>
	<entry name="removal_action" mtime="1481125643" type="string">
		<stringvalue>lock_screen</stringvalue>
	</entry>
</gconf>
[root@dhcp129-184 ~]# cat /etc/pam.d/smartcard-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
#auth        [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card card_only
auth        sufficient    pam_sss.so allow_missing_name
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so

#password    required      pam_pkcs11.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

[root@dhcp129-184 ~]# rpm -qi sssd
Name        : sssd                         Relocations: (not relocatable)
Version     : 1.13.3                            Vendor: Red Hat, Inc.
Release     : 54.el6                        Build Date: Fri 16 Dec 2016 03:57:57 AM EST
Install Date: Fri 16 Dec 2016 10:12:08 AM EST      Build Host: x86-042.build.eng.bos.redhat.com
Group       : Applications/System           Source RPM: sssd-1.13.3-54.el6.src.rpm
Size        : 35147                            License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://fedorahosted.org/sssd/
Summary     : System Security Services Daemon

Verification steps:

1. Install ipa-client and configure sssd and pam files to enable smartcard login.
2. Additional config required for verifying this bug are as follows

gconftool-2 --direct --config-source=xml:readwrite:/etc/gconf/gconf.xml.mandatory -s /desktop/gnome/peripherals/smartcard/removal_action lock_screen --type string

Change /etc/sysconfig/authconfig to have USESMARTCARD=yes

Changes mentioned in comment 11

3. Remove the smartcard to lock the screen. The locked screen prompts to insert the smartcard.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2017-0632.html