Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Prompting for kerberos user password after screen lock : logged in using smartcard pin with kerberos user
Version-Release number of selected component (if applicable):
pam_krb5-2.4.8-4.el7.x86_64
pam_pkcs11-0.6.2-23.el7.x86_64
How reproducible:
always
Steps to Reproduce:
1. Login using smartcard pin with kerberos user
2. Lock the screen
Actual results:
Screen unlock prompts for kerberos user password
Expected results:
Screen unlock should prompt for smartcard pin
Additional info:
Seeing the same issue when logging in using a smartcard that has been enrolled with a local user (non-kerberos). So changing the component to pam_pkcs11.
OK, here's what I'm seeing:
If I turn on smartcard login and turn on lock when card is removed (using /sbin/system-config-authentication from authconfig-gtk):
- I can log in using the smart card.
- If I remove the smart card the display lock and the display goes blank.
- If I insert the smart card again, it's read, but it does not trigger the screen saver.
- Moving the mouse or hitting enter does bring up the smart card prompt, however.
Is this what you were seeing?
rpm -q pam_pkcs11
pam_pkcs11-0.6.2-23.el7.x86_64
rpm -q coolkey
coolkey-1.1.0-28.2.el7_bob.x86_64
Note: if that's the case, pam_pkcs11 isn't involved. the screen-saver and coolkey are the ones that decide how to bring up the lock. pam_pkcs11 is involved after the fact (when the screen saver decides to authenticate, it then calls pam_pkcs11.
bob
Bob,
For this bug this is not what I am seeing. I have turned on smartcard login, ignore when smartcard is removed, turned on create home directory on login.
-I manually lock the screen
-Move the mouse
-Unlock screen prompts for password of the user on the smartcard and not the smartcard pin
Yes Bob. I noticed that you are using a different coolkey build could try with the build in https://errata.devel.redhat.com/advisory/21064/builds, because with this build I also see that lock screen on smartcard removal is also not working. I am changing the bug component to coolkey.
Comment 11Ray Strode [halfline]
2015-09-10 18:04:27 UTC
*** This bug has been marked as a duplicate of bug 1260081 ***
OK, it looks like Ray answered the question I was going to ask before I asked it. This is an existing bug in RHEL 7, not related to pam_pkcs11 or coolkey (neither even gets called in the failing case).