Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Created attachment 1771951[details]
test build
Hi,
thank you for you patience, please find attached a tar ball with a SSSD test build which should reject the login with the user password if you require Smartcard authentication.
In my test kscreenlocker displays the message asking to insert the proper Smartcard only for a very short time. I haven't found an option to make kscreenlocker to display it longer.
bye,
Sumit
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2022:8325
Description of problem: I'm attempting to require the use of smartcards everywhere. authselect profile: Profile ID: sssd Enabled features: - with-smartcard - with-smartcard-required - with-smartcard-lock-on-removal - with-sudo - with-custom-automount - with-mkhomedir - with-faillock I had to modify /etc/pam.d/system-auth to add "kde" (use by plasma screen locker) to the list of services below: auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_faillock.so preauth silent auth [success=1 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kde:kscreensaver quiet use_uid auth [success=done ignore=ignore default=die] pam_sss.so require_cert_auth ignore_authinfo_unavail auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=2 ignore=ignore success=ok] pam_localuser.so auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth auth sufficient pam_unix.so nullok try_first_pass auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail auth required pam_deny.so When I lock the screen and unlock with my password, the message: Please insert smart card labeled Orion Poplawski is displayed, but then the screen unlocks. pam log messgges: kcheckpass[7557]: pam_sss(kde:auth): User info message: Please insert smart card labeled Orion Poplawski kcheckpass[7557]: pam_sss(kde:auth): authentication success; logname=orion uid=22603 euid=22603 tty=:0 ruser= rhost= user=orion sssd.conf has: [pam] pam_cert_auth = True # kscreensaver for EL7, kde for Fedora pam_p11_allowed_services = +kscreensaver, +kde Version-Release number of selected component (if applicable): sssd-2.3.0-9.el8.x86_64 FWIW - authselect issue - https://github.com/authselect/authselect/issues/234