On Thu, Nov 15, 2018 at 01:23:37PM +0100, Natxo Asenjo wrote:
On Thu, Nov 15, 2018 at 11:49 AM Alexander Bokovoy
<abokovoy(a)redhat.com>
wrote:
>
> >Am I doing something wrong or is this to be expected?
> Enable debug_level=9 in sssd configuration (domain section) and try to
> login with smartcard, then provide krb5_child.log to see what's
> happening.
>
ok, here comes (anonymized) as attachment.
What's curious is that when running sudo -i and entering the pin code, root
does get a ticket for my user account (no password prompt).
@Sumit Bose <sbose(a)redhat.com> , I am logging in locally (console or gdm)
to a fedora 29 client. I tried using the advise scripts, but there are
several changes to the way smart cards work in fedora 29 compared to
rhel/centos 7, so the scripts do not work properly. I solved those problems
in an earlier thread.
The pkinit plugin cannot find a valid certificate 'PKINIT client has no
configured identity; giving up'.
One reason (and that's why I ask for the advise script) are missing CA
certificates. Do you have something like
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
in the section from the SUB.DOMAIN.TLD realm or in the [libdefaults]
section? Those files should contain the IPA CA certificates so that the
KDC certificate can be validated and the CA certificates of the issuer
of the certificate from the Smartcard.
Additionally please check if there are SELinux AVCs which might indicate
that krb5_child is not allowed to read the files with the CA
certificates.
If the CA certificates are available calling
KRB5_TRACE=/dev/stdout kinit -X
'X509_user_identity=PKCS11:module_name=/usr/lib64/pkcs11/opensc-pkcs11.so:token=userxx:certid=01
userxx(a)SUB.DOMAIN.TLD
should correspond to what SSSD is trying to do. If you run this with
strace it might give some hints if there are other issues.
If strace does not help, I can prepare a special debug version of the
pkinit plugin which adds lots of additional debug output. For this
please let me know the package version of krb5-pkinit you are using.
bye,
Sumit
--
regards,
Natxo