This upstream merge request should fix the handling of PKCS#11 certificate PINs:

  https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/965

Note that PINs should not be appended to the PKCS#11 URI, but they should be in the *-password properties as in:

 # nmcli -o -s connection show eth-pkcs11 
 connection.id:                          eth-pkcs11
 connection.uuid:                        7bc89c12-5426-4584-8eb4-39fd4d6be01c
 connection.type:                        802-3-ethernet
 connection.interface-name:              eth0
 connection.timestamp:                   1629389530
 802-1x.eap:                             tls
 802-1x.identity:                        user
 802-1x.ca-cert:                         pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=01d2a3ab349b7801;token=myslot;object=ca-cert;type=cert
 802-1x.ca-cert-password:                1234
 802-1x.ca-cert-password-flags:          0 (none)
 802-1x.client-cert:                     pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=01d2a3ab349b7801;token=myslot;object=client-cert;type=cert
 802-1x.client-cert-password:            1234
 802-1x.client-cert-password-flags:      0 (none)
 802-1x.private-key:                     pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=01d2a3ab349b7801;token=myslot;object=client-key;type=private
 802-1x.private-key-password:            1234
 802-1x.private-key-password-flags:      0 (none)
 802-1x.pin-flags:                       0 (none)

Hi Mike, please find here a scratch build of the patch for RHEL-7.9:

https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=39369588


Note that at this point the barrier to get something fixed in RHEL-7.9 is very high. I don't think that this issue qualifies.

ok in 1.36.0-1:

1) when neither of 802-1x.private-key nor 802-1x.private-key-password-flags options is set, NM correctly errors out early:

# nmcli c add type ethernet  ifname test8X con-name con_ethernet autoconnect no 802-1x.eap tls 802-1x.identity test 802-1x.ca-cert /tmp/certs/test_user.ca.pem 802-1x.client-cert 'pkcs11:token=nmci;object=nmclient' 802-1x.client-cert-password-flags 4 802-1x.private-key 'pkcs11:token=nmci;object=nmclient'
Connection 'con_ethernet' (e729bb0a-5c06-47a9-8a53-e7f31b9d5d74) successfully added.
# nmcli c up id con_ethernet 
Secrets are required to access the wired network 'con_ethernet'
Warning: password for '802-1x.identity' not given in 'passwd-file' and nmcli cannot ask without '--ask' option.
Error: Connection activation failed: Secrets were required, but not provided
Hint: use 'journalctl -xe NM_CONNECTION=e729bb0a-5c06-47a9-8a53-e7f31b9d5d74 + NM_DEVICE=test8X' to get more details.


2) with private-key-password-flags kept unset and card PIN saved in private-key-password, PIN is given correctly to hostapd and connection is established:

[root@rhel8-at-cihla NetworkManager-ci]# nmcli c modify id con_ethernet 802-1x.private-key-password 1234
[root@rhel8-at-cihla NetworkManager-ci]# nmcli c up id con_ethernet 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/12)


3) with private-key-password unset, private-key-password-flags set to 4 (or 'not-required') and PIN value added to PKCS11 URI (as a means to simulate readers with physical PIN keyboard), NM passes URI as-is and doesn't do anything about unset password:

# nmcli c del id con_ethernet 
Connection 'con_ethernet' (e729bb0a-5c06-47a9-8a53-e7f31b9d5d74) successfully deleted.
# nmcli c add type ethernet  ifname test8X con-name con_ethernet autoconnect no 802-1x.eap tls 802-1x.identity test 802-1x.ca-cert /tmp/certs/test_user.ca.pem 802-1x.client-cert 'pkcs11:token=nmci;object=nmclient' 802-1x.client-cert-password-flags 4 802-1x.private-key 'pkcs11:token=nmci;object=nmclient?pin-value=1234' 802-1x.private-key-password-flags not-required 
Connection 'con_ethernet' (ca44e36c-1304-49f8-b9ca-9a9a11c9c2ed) successfully added.
# nmcli c up id con_ethernet 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/13)


All these cases are tested in NM CI suite.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (NetworkManager bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2022:1985