And if I specify the card LABEL:
# KRB5_TRACE=/dev/stdout kinit -X
X509_user_identity='PKCS11:opensc-pkcs11.so:certlabel=Certificate for PIV
Authentication' username
[22278] 1558726069.978962: Getting initial credentials for username@DOMAIN
[22278] 1558726069.978964: Sending unauthenticated request
[22278] 1558726069.978965: Sending request (172 bytes) to DOMAIN
[22278] 1558726069.978966: Initiating TCP connection to stream 192.168.162.10:88
[22278] 1558726069.978967: Sending TCP request to stream 192.168.162.10:88
[22278] 1558726069.978968: Received answer (298 bytes) from stream 192.168.162.10:88
[22278] 1558726069.978969: Terminating TCP connection to stream 192.168.162.10:88
[22278] 1558726069.978970: Response was from master KDC
[22278] 1558726069.978971: Received error from KDC: -1765328359/Additional
pre-authentication required
[22278] 1558726069.978974: Preauthenticating using KDC method data
[22278] 1558726069.978975: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD
(15), PA-PK-AS-REQ_OLD (14), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147),
PA-ENC-TIMESTAMP (2), PA-FX-COOKIE (133)
[22278] 1558726069.978976: Selected etype info: etype aes256-cts, salt
",NA[[snip]]&?", params ""
[22278] 1558726069.978977: Received cookie: MIT
[22278] 1558726076.4420: Preauth module pkinit (147) (info) returned: 0/Success
PIV_II PIN:
[22278] 1558726085.757813: PKINIT loading CA certs and CRLs from FILE
[22278] 1558726085.757814: PKINIT loading CA certs and CRLs from FILE
[22278] 1558726085.757815: PKINIT client computed kdc-req-body checksum
9/09AD53A5919AEB906D
[22278] 1558726085.757817: PKINIT client making DH request
[22278] 1558726086.960954: Preauth module pkinit (16) (real) returned: 0/Success
[22278] 1558726086.960955: Produced preauth for next request: PA-FX-COOKIE (133),
PA-PK-AS-REQ (16)
[22278] 1558726086.960956: Sending request (6924 bytes) to DOMAIN
[22278] 1558726086.960957: Initiating TCP connection to stream 192.168.162.10:88
[22278] 1558726086.960958: Sending TCP request to stream 192.168.162.10:88
[22278] 1558726087.25096: Received answer (1641 bytes) from stream 192.168.162.10:88
[22278] 1558726087.25097: Terminating TCP connection to stream 192.168.162.10:88
[22278] 1558726087.25098: Response was from master KDC
[22278] 1558726087.25099: Processing preauth types: PA-PK-AS-REP (17), PA-ETYPE-INFO2
(19)
[22278] 1558726087.25100: Selected etype info: etype aes256-cts, salt
",NA#[[snip]]RE&?", params ""
[22278] 1558726087.25101: PKINIT client could not verify DH reply
[22278] 1558726087.25102: Preauth module pkinit (17) (real) returned:
-1765328360/Preauthentication failed
[22278] 1558726087.25103: Produced preauth for next request: (empty)
[22278] 1558726087.25104: Getting AS key, salt ",NA[[snip]]E&?", params
""
Password for username@DOMAIN: