1464253 – Token name of CAC cards not displayed correctly

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1464253 - Token name of CAC cards not displayed correctly

Summary: Token name of CAC cards not displayed correctly

Keywords:
Status:	CLOSED DUPLICATE of bug 1449740
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	opensc
Sub Component:
Version:	7.4
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Jakub Jelen
QA Contact:	Release Test Team
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2017-06-22 19:49 UTC by Roshni
Modified:	2018-01-12 17:58 UTC (History)
CC List:	1 user (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2017-06-28 14:43:46 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Description Roshni 2017-06-22 19:49:05 UTC

Description of problem:
Token name of CAC cards not displayed correctly

Version-Release number of selected component (if applicable):
opensc-0.16.0-5.20170227git777e2a3.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. Insert CAC card or yubikey token

[root@dhcp129-112 ~]# modutil -list -dbdir /etc/pki/nssdb/

Listing of PKCS #11 Modules
-----------------------------------------------------------
  1. NSS Internal PKCS #11 Module
	 slots: 2 slots attached
	status: loaded

	 slot: NSS Internal Cryptographic Services
	token: NSS Generic Crypto Services

	 slot: NSS User Private Key and Certificate Services
	token: NSS Certificate DB

  2. CoolKey PKCS #11 Module
	library name: libcoolkeypk11.so
	 slots: 1 slot attached
	status: loaded

	 slot: OMNIKEY AG CardMan 3021 00 00
	token: LAST.DAY.2001428082

  3. opensc module
	library name: opensc-pkcs11.so
	 slots: 1 slot attached
	status: loaded

	 slot: OMNIKEY AG CardMan 3021 00 00
	token: PIV Card Holder pin (PIV_II)


[root@dhcp129-112 ~]# modutil -list -dbdir /etc/pki/nssdb/

Listing of PKCS #11 Modules
-----------------------------------------------------------
  1. NSS Internal PKCS #11 Module
	 slots: 2 slots attached
	status: loaded

	 slot: NSS Internal Cryptographic Services
	token: NSS Generic Crypto Services

	 slot: NSS User Private Key and Certificate Services
	token: NSS Certificate DB

  2. CoolKey PKCS #11 Module
	library name: libcoolkeypk11.so
	 slots: 1 slot attached
	status: loaded

	 slot: Yubico Yubikey 4 OTP+U2F+CCID 00 00
	token: alice

  3. opensc module
	library name: opensc-pkcs11.so
	 slots: 1 slot attached
	status: loaded

	 slot: Yubico Yubikey 4 OTP+U2F+CCID 00 00
	token: PIV Card Holder pin (PIV_II)

I see the same token name on the GDm login screen

Actual results:


Expected results:


Additional info:

Comment 2 Jakub Jelen 2017-06-23 06:36:24 UTC

Hello Roshni.
This behavior is caused by the fact that the card you are using is dual card and is recognized by both PIV and CAC driver. In OpenSC upstream the PIV driver has a priority over the CAC one (unlike in Coolkey) -- CAC is these days quite much abandoned standard. This is change of behavior between packages, but it is not expected that it will be completely drop-in replacement. Also following Upstream behavior is desirable.

You can verify this bug if you configure the drivers in the other order in `/etc/opensc-x86_64.conf` and modify the line containing `card_drivers` to something like this:

    card_drivers = cac, piv, coolkey;

If this will resolve the problem, we can probably close this as a duplicate of the bug #1449740 which discuss the labels on the PIV cards.

Comment 3 Roshni 2017-06-27 15:48:53 UTC

(In reply to Jakub Jelen from comment #2)
> Hello Roshni.
> This behavior is caused by the fact that the card you are using is dual card
> and is recognized by both PIV and CAC driver. In OpenSC upstream the PIV
> driver has a priority over the CAC one (unlike in Coolkey) -- CAC is these
> days quite much abandoned standard. This is change of behavior between
> packages, but it is not expected that it will be completely drop-in
> replacement. Also following Upstream behavior is desirable.
> 
> You can verify this bug if you configure the drivers in the other order in
> `/etc/opensc-x86_64.conf` and modify the line containing `card_drivers` to
> something like this:
> 
>     card_drivers = cac, piv, coolkey;
The username can be seen with this config though a bit different from how coolkey lists it

2. CoolKey PKCS #11 Module
	library name: libcoolkeypk11.so
	 slots: 1 slot attached
	status: loaded

	 slot: OMNIKEY AG CardMan 3021 00 00
	token: LAST.DAY.2001428082

  3. opensc module
	library name: opensc-pkcs11.so
	 slots: 1 slot attached
	status: loaded

	 slot: OMNIKEY AG CardMan 3021 00 00
	token: CAC II (LAST.DAY.2001428082)
> 
> If this will resolve the problem, we can probably close this as a duplicate
> of the bug #1449740 which discuss the labels on the PIV cards.

Comment 4 Jakub Jelen 2017-06-28 13:05:34 UTC

Yes. That is expected. The OpenSC is adding a driver identification here. I don't think it is something we should bother with.

I added an item to the KBA:

https://access.redhat.com/node/3034441/draft

Is there anything more to do here?

Comment 5 Roshni 2017-06-28 13:32:45 UTC

(In reply to Jakub Jelen from comment #4)
> Yes. That is expected. The OpenSC is adding a driver identification here. I
> don't think it is something we should bother with.
> 
> I added an item to the KBA:
> 
> https://access.redhat.com/node/3034441/draft
I do not have permissions to access the above
> 
> Is there anything more to do here?

Comment 6 Roshni 2017-06-28 14:43:46 UTC


*** This bug has been marked as a duplicate of bug 1449740 ***

Note You need to log in before you can comment on or make changes to this bug.