Bug 1464253 - Token name of CAC cards not displayed correctly
Token name of CAC cards not displayed correctly
Status: CLOSED DUPLICATE of bug 1449740
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: opensc (Show other bugs)
7.4
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Jakub Jelen
Release Test Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-22 15:49 EDT by Roshni
Modified: 2017-06-28 10:43 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-06-28 10:43:46 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Roshni 2017-06-22 15:49:05 EDT
Description of problem:
Token name of CAC cards not displayed correctly

Version-Release number of selected component (if applicable):
opensc-0.16.0-5.20170227git777e2a3.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. Insert CAC card or yubikey token

[root@dhcp129-112 ~]# modutil -list -dbdir /etc/pki/nssdb/

Listing of PKCS #11 Modules
-----------------------------------------------------------
  1. NSS Internal PKCS #11 Module
	 slots: 2 slots attached
	status: loaded

	 slot: NSS Internal Cryptographic Services
	token: NSS Generic Crypto Services

	 slot: NSS User Private Key and Certificate Services
	token: NSS Certificate DB

  2. CoolKey PKCS #11 Module
	library name: libcoolkeypk11.so
	 slots: 1 slot attached
	status: loaded

	 slot: OMNIKEY AG CardMan 3021 00 00
	token: LAST.DAY.2001428082

  3. opensc module
	library name: opensc-pkcs11.so
	 slots: 1 slot attached
	status: loaded

	 slot: OMNIKEY AG CardMan 3021 00 00
	token: PIV Card Holder pin (PIV_II)


[root@dhcp129-112 ~]# modutil -list -dbdir /etc/pki/nssdb/

Listing of PKCS #11 Modules
-----------------------------------------------------------
  1. NSS Internal PKCS #11 Module
	 slots: 2 slots attached
	status: loaded

	 slot: NSS Internal Cryptographic Services
	token: NSS Generic Crypto Services

	 slot: NSS User Private Key and Certificate Services
	token: NSS Certificate DB

  2. CoolKey PKCS #11 Module
	library name: libcoolkeypk11.so
	 slots: 1 slot attached
	status: loaded

	 slot: Yubico Yubikey 4 OTP+U2F+CCID 00 00
	token: alice

  3. opensc module
	library name: opensc-pkcs11.so
	 slots: 1 slot attached
	status: loaded

	 slot: Yubico Yubikey 4 OTP+U2F+CCID 00 00
	token: PIV Card Holder pin (PIV_II)

I see the same token name on the GDm login screen

Actual results:


Expected results:


Additional info:
Comment 2 Jakub Jelen 2017-06-23 02:36:24 EDT
Hello Roshni.
This behavior is caused by the fact that the card you are using is dual card and is recognized by both PIV and CAC driver. In OpenSC upstream the PIV driver has a priority over the CAC one (unlike in Coolkey) -- CAC is these days quite much abandoned standard. This is change of behavior between packages, but it is not expected that it will be completely drop-in replacement. Also following Upstream behavior is desirable.

You can verify this bug if you configure the drivers in the other order in `/etc/opensc-x86_64.conf` and modify the line containing `card_drivers` to something like this:

    card_drivers = cac, piv, coolkey;

If this will resolve the problem, we can probably close this as a duplicate of the bug #1449740 which discuss the labels on the PIV cards.
Comment 3 Roshni 2017-06-27 11:48:53 EDT
(In reply to Jakub Jelen from comment #2)
> Hello Roshni.
> This behavior is caused by the fact that the card you are using is dual card
> and is recognized by both PIV and CAC driver. In OpenSC upstream the PIV
> driver has a priority over the CAC one (unlike in Coolkey) -- CAC is these
> days quite much abandoned standard. This is change of behavior between
> packages, but it is not expected that it will be completely drop-in
> replacement. Also following Upstream behavior is desirable.
> 
> You can verify this bug if you configure the drivers in the other order in
> `/etc/opensc-x86_64.conf` and modify the line containing `card_drivers` to
> something like this:
> 
>     card_drivers = cac, piv, coolkey;
The username can be seen with this config though a bit different from how coolkey lists it

2. CoolKey PKCS #11 Module
	library name: libcoolkeypk11.so
	 slots: 1 slot attached
	status: loaded

	 slot: OMNIKEY AG CardMan 3021 00 00
	token: LAST.DAY.2001428082

  3. opensc module
	library name: opensc-pkcs11.so
	 slots: 1 slot attached
	status: loaded

	 slot: OMNIKEY AG CardMan 3021 00 00
	token: CAC II (LAST.DAY.2001428082)
> 
> If this will resolve the problem, we can probably close this as a duplicate
> of the bug #1449740 which discuss the labels on the PIV cards.
Comment 4 Jakub Jelen 2017-06-28 09:05:34 EDT
Yes. That is expected. The OpenSC is adding a driver identification here. I don't think it is something we should bother with.

I added an item to the KBA:

https://access.redhat.com/node/3034441/draft

Is there anything more to do here?
Comment 5 Roshni 2017-06-28 09:32:45 EDT
(In reply to Jakub Jelen from comment #4)
> Yes. That is expected. The OpenSC is adding a driver identification here. I
> don't think it is something we should bother with.
> 
> I added an item to the KBA:
> 
> https://access.redhat.com/node/3034441/draft
I do not have permissions to access the above
> 
> Is there anything more to do here?
Comment 6 Roshni 2017-06-28 10:43:46 EDT

*** This bug has been marked as a duplicate of bug 1449740 ***

Note You need to log in before you can comment on or make changes to this bug.