RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1259515 - Prompting for kerberos user password after screen lock : logged in using smartcard pin with kerberos user
Summary: Prompting for kerberos user password after screen lock : logged in using smar...
Keywords:
Status: CLOSED DUPLICATE of bug 1260081
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: coolkey
Version: 7.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Bob Relyea
QA Contact: Asha Akkiangady
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-09-02 20:45 UTC by Roshni
Modified: 2015-09-10 22:30 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-09-10 18:04:27 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Roshni 2015-09-02 20:45:33 UTC 
Description of problem:
Prompting for kerberos user password after screen lock : logged in using smartcard pin with kerberos user

Version-Release number of selected component (if applicable):
pam_krb5-2.4.8-4.el7.x86_64
pam_pkcs11-0.6.2-23.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. Login using smartcard pin with kerberos user
2. Lock the screen

Actual results:
Screen unlock prompts for kerberos user password

Expected results:
Screen unlock should prompt for smartcard pin

Additional info:
Comment 3 Sumit Bose 2015-09-03 07:34:20 UTC 
Can you attach your PAM configuration?
Comment 5 Roshni 2015-09-03 19:52:27 UTC 
Seeing the same issue when logging in using a smartcard that has been enrolled with a local user (non-kerberos). So changing the component to pam_pkcs11.
Comment 6 Bob Relyea 2015-09-09 00:48:18 UTC 
OK, here's what I'm seeing:

If I turn on smartcard login and turn on lock when card is removed (using /sbin/system-config-authentication from authconfig-gtk):
  - I can log in using the smart card.
  - If I remove the smart card the display lock and the display goes blank.
  - If I insert the smart card again, it's read, but it does not trigger the screen saver.
  - Moving the mouse or hitting enter does bring up the smart card prompt, however.

Is this what you were seeing?

rpm -q pam_pkcs11
pam_pkcs11-0.6.2-23.el7.x86_64

rpm -q coolkey
coolkey-1.1.0-28.2.el7_bob.x86_64

Note: if that's the case, pam_pkcs11 isn't involved. the screen-saver and coolkey are the ones that decide how to bring up the lock. pam_pkcs11 is involved after the fact (when the screen saver decides to authenticate, it then calls pam_pkcs11.

bob
Comment 7 Bob Relyea 2015-09-09 21:33:54 UTC 
roshni, is this what you are seeing as well, or your you seeing something different?
Comment 8 Roshni 2015-09-10 13:56:58 UTC 
Bob,

For this bug this is not what I am seeing. I have turned on smartcard login, ignore when smartcard is removed, turned on create home directory on login.

-I manually lock the screen
-Move the mouse
-Unlock screen prompts for password of the user on the smartcard and not the smartcard pin
Comment 9 Bob Relyea 2015-09-10 16:36:42 UTC 
Roshni, did you log in using the smart card?
Comment 10 Roshni 2015-09-10 16:40:45 UTC 
Yes Bob. I noticed that you are using a different coolkey build could try with the build in https://errata.devel.redhat.com/advisory/21064/builds, because with this build I also see that lock screen on smartcard removal is also not working. I am changing the bug component to coolkey.
Comment 11 Ray Strode [halfline] 2015-09-10 18:04:27 UTC 

*** This bug has been marked as a duplicate of bug 1260081 ***
Comment 12 Bob Relyea 2015-09-10 22:30:30 UTC 
OK, it looks like Ray answered the question I was going to ask before I asked it. This is an existing bug in RHEL 7, not related to pam_pkcs11 or coolkey (neither even gets called in the failing case).
Note You need to log in before you can comment on or make changes to this bug.