3:08 p.m.
I did not run the script, because I had already done most of what is in the script by the
time I found it. I have imported all of the certificates into the /etc/pki/nss database
and I ran this command against my certificate.
Command: certutil -V -n 'mycertificate' -u CSR -l -a -d /etc/pki/nssdb, entered
my PIN and I got the output: certutil: certificate is valid. So, I believe that I added
all of the certificates to the system correctly.
I have removed pam_pkcs11 and installed krb5-pkinit-openssl. I enabled opensc using the
modutil command. When I run the command: modutil -list -dbdir /etc/pki/nssdb, I can see
my card reader and smart card.
I also ran the command: authconfig --enablesssd --enablesssdauth --enablesmartcard
--smartcardmodule=sssd --smartcardaction=1 --updateall, cleared the sss cache and rebooted
the system.
When the system reboots and I get to the GDM screen, I don't get asked for my PIN.
It reads my smart card and then says Sorry, that's didn't work. Please try
again.
Here is the log from sssd_pam:
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found token
name [my_token_name].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found module
name [opensc-pkcs11.so].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found key id
[0001].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found label
[my_ID_Certificate].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found cert
["CERTIFICATE REMOVED"].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x1000): Cert
["CERTIFICATE REMOVED"] does not match matching rules and is ignored.
(Tue May 12 19:28:03 2020) [sssd[pam]] [pam_forwarder_cert_cb] (0x0020): No certificate
found and no logon name given, authentication not possible.
I ran the command "ipa certmap-match mycertificate.pem: and it associated this
certificate with the correct AD account and AD domain.
Here is a copy of my SSSD config file:
[domain/idm.myhome.domain]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = idm.myhome.domain
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = idmsvr01.idm.myhome.domain
chpass_provider = ipa
ipa_server = idmsvr01.idm.myhome.domain
ipa_server_mode = True
ldap_tls_cacert = /etc/ipa/ca.crt
debug_level = 9
krb5_auth_timeout = 60
ldap_user_certificate = userCertificate;binary
[sssd]
services = ifp, nss, sudo, pam, ssh
debug_level = 9
domains = idm.myhome.domain
certificate_verification = no_ocsp
[nss]
memcache_timeout = 600
homedir_substring = /home
debug_level = 9
[pam]
debug_level = 9
p11_child_timeout = 60
pam_cert_auth = True
[sudo]
debug_level = 9
[autofs]
debug_level = 9
[ssh]
debug_level = 9
[pac]
debug_level = 9
[ifp]
debug_level = 9
allowed_uids = ipaapi, root
[secrets]
debug_level = 9
[session_recording]
debug_level = 9