p11_child and removable devices

[Vladimir Vakhlamov]

Hello

Guys could anybody clarify why p11_child handles only first found removable device? Why wouldn't it handle all removable slots?

[Alexey Tikhonov]

Hi,

On Tue, Mar 9, 2021 at 12:30 PM Vladimir Vakhlamov  wrote:
> Hello
>
> Guys could anybody clarify why p11_child handles only first found removable device? Why wouldn't it handle all removable slots?

Could you please explain your setup in greater details please?

Don't you intermix "device" (module) and "slot"? I think a single
module can have a number of slots. And IIUC p11_child iterates over
all of them while looking for a cert initially:
https://github.com/SSSD/sssd/blob/master/src/p11_child/p11_child_openssl.c#L...

[Vladimir Vakhlamov]

> Don't you intermix "device" (module) and "slot"?

i guess i don't. I just meant this condition:
https://github.com/SSSD/sssd/blob/8e8ccca5d647b373ce633df18578376df0681473/s...

When token has more than one removable slot in that place we don't try to find certificates for another removable slot.
 I faced with problem when my certificate located in second removable slot.

[Sumit Bose]

On Tue, Mar 09, 2021 at 12:16:36PM -0000, Vladimir Vakhlamov wrote:
> > Don't you intermix "device" (module) and "slot"?
>
> i guess i don't. I just meant this condition:
> https://github.com/SSSD/sssd/blob/8e8ccca5d647b373ce633df18578376df0681473/s...

Hi,

this is a known issue, https://github.com/SSSD/sssd/issues/5025. The
current behavior was mainly added to behave similar to pam_pkcs11.
> When token has more than one removable slot in that place we don't try to find certificates for another removable slot.
>  I faced with problem when my certificate located in second removable slot.

As a workaround it might be possible to add a PKCS#11 URI with the
p11_uri option to tell SSSD to always use a specific reader, see man
sssd.conf for details.

bye,
Sumit
> sssd-devel mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail].o...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Vladimir Vakhlamov]

Alexey, Sumit
Thank you very much for the information!