Red Hat Bugzilla – Bug 1464253
Token name of CAC cards not displayed correctly
Last modified: 2018-01-12 12:58:30 EST
Description of problem: Token name of CAC cards not displayed correctly Version-Release number of selected component (if applicable): opensc-0.16.0-5.20170227git777e2a3.el7.x86_64 How reproducible: always Steps to Reproduce: 1. Insert CAC card or yubikey token [root@dhcp129-112 ~]# modutil -list -dbdir /etc/pki/nssdb/ Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificate Services token: NSS Certificate DB 2. CoolKey PKCS #11 Module library name: libcoolkeypk11.so slots: 1 slot attached status: loaded slot: OMNIKEY AG CardMan 3021 00 00 token: LAST.DAY.2001428082 3. opensc module library name: opensc-pkcs11.so slots: 1 slot attached status: loaded slot: OMNIKEY AG CardMan 3021 00 00 token: PIV Card Holder pin (PIV_II) [root@dhcp129-112 ~]# modutil -list -dbdir /etc/pki/nssdb/ Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificate Services token: NSS Certificate DB 2. CoolKey PKCS #11 Module library name: libcoolkeypk11.so slots: 1 slot attached status: loaded slot: Yubico Yubikey 4 OTP+U2F+CCID 00 00 token: alice 3. opensc module library name: opensc-pkcs11.so slots: 1 slot attached status: loaded slot: Yubico Yubikey 4 OTP+U2F+CCID 00 00 token: PIV Card Holder pin (PIV_II) I see the same token name on the GDm login screen Actual results: Expected results: Additional info:
Hello Roshni. This behavior is caused by the fact that the card you are using is dual card and is recognized by both PIV and CAC driver. In OpenSC upstream the PIV driver has a priority over the CAC one (unlike in Coolkey) -- CAC is these days quite much abandoned standard. This is change of behavior between packages, but it is not expected that it will be completely drop-in replacement. Also following Upstream behavior is desirable. You can verify this bug if you configure the drivers in the other order in `/etc/opensc-x86_64.conf` and modify the line containing `card_drivers` to something like this: card_drivers = cac, piv, coolkey; If this will resolve the problem, we can probably close this as a duplicate of the bug #1449740 which discuss the labels on the PIV cards.
(In reply to Jakub Jelen from comment #2) > Hello Roshni. > This behavior is caused by the fact that the card you are using is dual card > and is recognized by both PIV and CAC driver. In OpenSC upstream the PIV > driver has a priority over the CAC one (unlike in Coolkey) -- CAC is these > days quite much abandoned standard. This is change of behavior between > packages, but it is not expected that it will be completely drop-in > replacement. Also following Upstream behavior is desirable. > > You can verify this bug if you configure the drivers in the other order in > `/etc/opensc-x86_64.conf` and modify the line containing `card_drivers` to > something like this: > > card_drivers = cac, piv, coolkey; The username can be seen with this config though a bit different from how coolkey lists it 2. CoolKey PKCS #11 Module library name: libcoolkeypk11.so slots: 1 slot attached status: loaded slot: OMNIKEY AG CardMan 3021 00 00 token: LAST.DAY.2001428082 3. opensc module library name: opensc-pkcs11.so slots: 1 slot attached status: loaded slot: OMNIKEY AG CardMan 3021 00 00 token: CAC II (LAST.DAY.2001428082) > > If this will resolve the problem, we can probably close this as a duplicate > of the bug #1449740 which discuss the labels on the PIV cards.
Yes. That is expected. The OpenSC is adding a driver identification here. I don't think it is something we should bother with. I added an item to the KBA: https://access.redhat.com/node/3034441/draft Is there anything more to do here?
(In reply to Jakub Jelen from comment #4) > Yes. That is expected. The OpenSC is adding a driver identification here. I > don't think it is something we should bother with. > > I added an item to the KBA: > > https://access.redhat.com/node/3034441/draft I do not have permissions to access the above > > Is there anything more to do here?
*** This bug has been marked as a duplicate of bug 1449740 ***