That worked! Thanks so much! I can login and successfully receive a kerberos ticket when
using a smartcard to login.
I also added the following to /etc/krb5.conf to match only a single cert for pkinit
pkinit_cert_match = &&<EKU>msScLogin,clientAuth<KU>digitalSignature
I am now down to 15 seconds for logins (which is better than the 30-50 seconds) which is
still on the slow side but I think the reason might be the 4 valid and 5 expired certs on
the card. I'm guessing it might be looping through all the certs which is adding all
this extra time. Just off the top of your head, do you know if there is a krb and p11
config somewhere that would allow me to limit desktop/client device logins to using only
slot 01 on the card and ignore the rest?
Thank you so much again.