[Bug 2251709] New: Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709

            Bug ID: 2251709
           Summary: Update to sssd-2.9.3 breaks user authentication via
                    smartcard
           Product: Fedora
           Version: 39
          Hardware: x86_64
                OS: Linux
            Status: NEW
         Component: sssd
          Assignee: sssd-maintainers(a)lists.fedoraproject.org
          Reporter: ralf.schneider(a)ra-s.org
        QA Contact: extras-qa(a)fedoraproject.org
                CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
                    lslebodn(a)redhat.com, mzidek(a)redhat.com,
                    pbrezina(a)redhat.com, sbose(a)redhat.com,
                    ssorce(a)redhat.com,
                    sssd-maintainers(a)lists.fedoraproject.org
  Target Milestone: ---
    Classification: Fedora



Description of problem:

I have set up a sssd / pam authentication via a pkcs15 certificate stored on a
Nitrokey Pro smartcard. Everything worked until doing a dfn update which
upgraded sssd to version 2.9.3.

Downgrading sssd-dbus and its dependencies to version 2.9.2 made things working
again.

Version-Release number of selected component (if applicable):

sssd-2.9.3-1.fc39.x86_64

How reproducible:

Steps to Reproduce:
1. dnf update
2. Using pamtester to check login and authentication procedure:
pamtester login $USER authenticate
3. Giving the user pin of the card leads to:
pamtester: Authentication failure
4. Giving the user's password leads to:
pamtester: successfully authenticated
5. Downgrading sssd-dbus
sudo dnf install sssd-dbus-2.9.2
6. Using pamtester to check login and authentication procedure:
pamtester login $USER authenticate
PIN for OpenPGP card (User PIN): 
pamtester: successfully authenticated

Actual results:

User not able to authenticate with pkcs15 certificate via smartcard

Expected results:

User should be able to authenticate with pkcs15 certificate via smartcard

Additional info:
--


-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Alexey Tikhonov <atikhono(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?(ralf.schneider@ra
                   |                            |-s.org)
           Doc Type|---                         |If docs needed, set a value



--- Comment #1 from Alexey Tikhonov <atikhono(a)redhat.com&gt; ---
Could you please provide '/var/log/sssd/p11_child.log' that covers failed
attempt?


-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Ralf Schneider <ralf.schneider(a)ra-s.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(ralf.schneider@ra |
                   |-s.org)                     |



--- Comment #2 from Ralf Schneider <ralf.schneider(a)ra-s.org&gt; ---
Created attachment 2001675
  --> https://bugzilla.redhat.com/attachment.cgi?id=2001675&action=edit
p11_child.log requested in comment #1


-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709



--- Comment #3 from Alexey Tikhonov <atikhono(a)redhat.com&gt; ---
Is this a local user (from /etc/passwd)?

Unfortunately, there is no enough information with the default debug level.

Could you please add 'debug_level = 9' to the '[pam]' section of
'sssd.conf',
clear SSSD logs and restart SSSD, repeat attempt and then provide sanitized
'p11_child.log' and 'sssd_pam.log'? And relevant parts of sssd.conf
itself, if
possible.


-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709



--- Comment #4 from Ralf Schneider <ralf.schneider(a)ra-s.org&gt; ---
Hi Alexey,

yes indeed it is a local user from /etc/passwd.

My sssd.conf with looks like 

-----------------------

[sssd]
enable_files_domain = True
services = nss, pam
domains = shadowutils
debug_level = 9

[nss]

[pam]
pam_cert_auth = True
pam_verbosity = 10
debug_level = 9

[domain/shadowutils]
id_provider = files
auth_provider = proxy
proxy_pam_target = sssd-shadowutils
proxy_fast_alias = True
debug_level = 9

[certmap/shadowutils/<snip>My user_id<snap>]
matchrule = <SUBJECT>.*CN=<snip>My user_id<snap>

-----------------------

The logs should contain two attempts to access the smartcard triggered by
pamtester:

In the first one I gave the password, 

pamtester login $USER authenticate
Password: 
pamtester: successfully authenticated

In the second one I tried the user key of the smartcard which returned: 

pamtester login $USER authenticate
Password: 
pamtester: Authentication failure


-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Ralf Schneider <ralf.schneider(a)ra-s.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Attachment|0                           |1
        #2001675 is|                            |
           obsolete|                            |



--- Comment #5 from Ralf Schneider <ralf.schneider(a)ra-s.org&gt; ---
Created attachment 2001678
  --> https://bugzilla.redhat.com/attachment.cgi?id=2001678&action=edit
Extended p11_child.log requested in comment #4


-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709



--- Comment #6 from Ralf Schneider <ralf.schneider(a)ra-s.org&gt; ---
Created attachment 2001679
  --> https://bugzilla.redhat.com/attachment.cgi?id=2001679&action=edit
sssd_pam.log requested in comment #4


-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709



--- Comment #7 from Sumit Bose <sbose(a)redhat.com&gt; ---
Hi,

can you try if adding

    local_auth_policy = enable:smartcard

to the [domain/...] section in sssd.conf and restarting SSSD will help?

bye,
Sumit


-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Ralf Schneider <ralf.schneider(a)ra-s.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |NOTABUG
             Status|NEW                         |CLOSED
        Last Closed|                            |2023-11-27 13:12:17



--- Comment #8 from Ralf Schneider <ralf.schneider(a)ra-s.org&gt; ---
Hi,

that did the trick!

Now everything works again as expected.

Thanks for the fast support,
Ralf


-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Alexey Tikhonov <atikhono(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?(ralf.schneider@ra
                   |                            |-s.org)



--- Comment #9 from Alexey Tikhonov <atikhono(a)redhat.com&gt; ---
One more question,
any reason you use
```
id_provider = files
```
and not
```
id_provider = proxy
proxy_lib_name = files
```
?

Take a note 'id_provider = files' is a deprecated functionality and most
probably will be gone starting F40.


-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...

[Bug 2251709] Update to sssd-2.9.3 breaks user authentication via smartcard

https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Ralf Schneider <ralf.schneider(a)ra-s.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(ralf.schneider@ra |
                   |-s.org)                     |



--- Comment #10 from Ralf Schneider <ralf.schneider(a)ra-s.org&gt; ---
Actually there is no special reason besides the fact that I glued the thing
together based on rather old HowTo as I now realized.

I now changed to

id_provider = proxy
proxy_lib_name = files

and still everything works as expected.

Thanks a lot for the hint!


-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2251709

Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...