Bug 1300421 - Screen locks and smart card is removed - must show a message to insert the correct smartcard
Screen locks and smart card is removed - must show a message to insert the co...
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: SSSD Maintainers
Steeve Goveas
Depends On: 1300420
  Show dependency treegraph
Reported: 2016-01-20 13:14 EST by Roshni
Modified: 2017-03-21 05:55 EDT (History)
10 users (show)

See Also:
Fixed In Version: sssd-1.13.3-54.el6
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1300420
Last Closed: 2017-03-21 05:55:09 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Roshni 2016-01-20 13:14:23 EST
+++ This bug was initially created as a clone of Bug #1300420 +++

Description of problem:
Screen locks and smart card is removed must show a message to insert the correct smartcard

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. ipa-client-install
2. sssd.conf should have the following
pam_cert_auth = True

3. add ipa user and add the signing cert on the smartcard to the ipa user
4. gdm login using smartcard pin
5. Smartcard is removed from the reader
6. Screen locks due to inactivity or manually 

Actual results:
Locked screen prompts for ipa user password.

Expected results:
Locked screen should show a message to insert the correct smartcard and when inserted it should prompt for the smartcard pin

Additional info:
Comment 2 Jakub Hrozek 2016-01-27 10:01:44 EST
Upstream ticket:
Comment 5 Roshni 2016-12-07 10:21:32 EST

Please provide testing instructions.
Comment 6 Sumit Bose 2016-12-07 10:41:42 EST
In RHEL6 screen-locking after removing the Smartcard can be enabled by calling

    gconftool-2 --direct --config-source=xml:readwrite:/etc/gconf/gconf.xml.mandatory -s /desktop/gnome/peripherals/smartcard/removal_action lock_screen --type string

Restarting gdm should make sure that the new configuration is loaded.
Comment 7 Sumit Bose 2016-12-07 10:43:58 EST
Additionally please comment out the line containing pam_pkcs11 in /etc/pam.d/smartcard-auth and add
    auth        sufficient    pam_sss.so allow_missing_name
to the auth section in /etc/pam.d/smartcard-auth directly before or after the commented out pam_pkcs11 line.
Comment 8 Roshni 2016-12-07 11:05:56 EST
After making changes as per comment 6 and comment 7, I did a reboot. I see that the screen locks when the smartcard is removed, when I move the mouse (card is still not inserted) it does not prompt to enter the specific smartcard. It prompts for the ipa user password.

[root@dhcp129-184 ~]# cat /etc/gconf/gconf.xml.mandatory/desktop/gnome/peripherals/smartcard/%gconf.xml
<?xml version="1.0"?>
	<entry name="removal_action" mtime="1481125643" type="string">
[root@dhcp129-184 ~]# cat /etc/pam.d/smartcard-auth
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
#auth        [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card card_only
auth        sufficient    pam_sss.so allow_missing_name
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so

#password    required      pam_pkcs11.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so
Comment 13 Roshni 2016-12-16 10:46:14 EST
[root@dhcp129-184 ~]# rpm -qi sssd
Name        : sssd                         Relocations: (not relocatable)
Version     : 1.13.3                            Vendor: Red Hat, Inc.
Release     : 54.el6                        Build Date: Fri 16 Dec 2016 03:57:57 AM EST
Install Date: Fri 16 Dec 2016 10:12:08 AM EST      Build Host: x86-042.build.eng.bos.redhat.com
Group       : Applications/System           Source RPM: sssd-1.13.3-54.el6.src.rpm
Size        : 35147                            License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://fedorahosted.org/sssd/
Summary     : System Security Services Daemon

Verification steps:

1. Install ipa-client and configure sssd and pam files to enable smartcard login.
2. Additional config required for verifying this bug are as follows

gconftool-2 --direct --config-source=xml:readwrite:/etc/gconf/gconf.xml.mandatory -s /desktop/gnome/peripherals/smartcard/removal_action lock_screen --type string

Change /etc/sysconfig/authconfig to have USESMARTCARD=yes

Changes mentioned in comment 11

3. Remove the smartcard to lock the screen. The locked screen prompts to insert the smartcard.
Comment 15 errata-xmlrpc 2017-03-21 05:55:09 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.