Bug 1449740
| Summary: | Label name does not match the username on the smartcard | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Roshni <rpattath> |
| Component: | opensc | Assignee: | Jakub Jelen <jjelen> |
| Status: | CLOSED ERRATA | QA Contact: | Asha Akkiangady <aakkiang> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | adam.winberg, jjelen, jstodola, mthacker, nmavrogi |
| Target Milestone: | rc | Keywords: | FutureFeature |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | opensc-0.16.0-6.20170227git777e2a3.el7 | Doc Type: | Enhancement |
| Doc Text: |
Feature: The PIV token labels show the cardholder name.
Reason: The token label is used by graphical application, for example in gnome login screen and previous generic name was confusing in this context.
Result: The PIV tokens now list the cardholder name in the token label field.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 18:28:08 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** Bug 1464253 has been marked as a duplicate of this bug. *** The PR for PIV was send upstream: https://github.com/OpenSC/OpenSC/pull/1133 *** Bug 1462000 has been marked as a duplicate of this bug. *** Jakub, Most of the PIV, CAC and non-CAC/PIV cards are displaying the expected label name in the GDM login screen except for 2 PIV cards. Those 2 PIV card have a global PIN and the label name I see on the login screen is "Welcome Global PIN (username)". When I use coolkey for the same 2 cards I notice it shows the correct label names. Yes, this was discussed in the upstream PR and it is how we expect it will behave. But I missed this "welcome message" context here since it was missing from the bug description. In this specific example, we can argue, that the wording in the other way "Welcome username (Global PIN)" would sound better. But in that case one with too-long name might end up without seeing the information which PIN should be used. I am not sure if we want to change it this late in testing (and so close to beta). The change would be trivial, but we should have to go through upstream and this change would affect all the card drivers, where these two labels would get switched. I can open a new low priority bug for this and mark this bug verified, if it sounds good to you. Yes, we can do that and decide later. Or we can just say that we are ok with this state. It is probably up to you. I see that there is still a difference in usability of gnome prompt from coolkey, but also on the other hand the change would be hard for upstream, since it would be quite drastic change with quite no benefit for them. [root@dhcp129-107 ~]# rpm -qi opensc Name : opensc Version : 0.16.0 Release : 7.20170227git777e2a3.el7 Architecture: x86_64 Install Date: Mon 18 Dec 2017 01:10:47 PM EST Group : System Environment/Libraries Size : 3262790 License : LGPLv2+ Signature : RSA/SHA256, Thu 09 Nov 2017 08:06:31 AM EST, Key ID 199e2f91fd431d51 Source RPM : opensc-0.16.0-7.20170227git777e2a3.el7.src.rpm Build Date : Thu 09 Nov 2017 07:40:40 AM EST Build Host : x86-039.build.eng.bos.redhat.com Relocations : (not relocatable) Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> Vendor : Red Hat, Inc. URL : https://github.com/OpenSC/OpenSC/wiki Summary : Smart card library and applications Labels of the smartcards were displayed as expected expect for the PIV cards with global pin (opened https://bugzilla.redhat.com/show_bug.cgi?id=1527187) Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0987 |
Description of problem: Jakub found the following: The PKCS#11 specification (pkcs-11v2-30b-d6.pdf) is very vague about the meaning of the label field in the CK_TOKEN_INFO structure: > application-defined label, assigned during token initialization. Must be padded with the blank character (‘ ‘). Should not be null-terminated. The coolkey is obviously setting the full cardholder name to this field: memcpy(label, personName, MIN(personLen, maxSize)); but OpenSC is using PIN label for some reason in combination with pkcs15-emulated label (one for a driver) p15card->tokeninfo->label = strdup("PIV_II"); We can probably push similar change to OpenSC, but I don't think this should be a blocker for RHEL7.4 release unless it will prevent the above use case with Gnome.