Access alternative yubikey slots

[Orion Poplawski]

I configured a YubiKey on Windows using the YubiKey minidriver with the
following certificates:

- my "orion" certificate - went into slot 9a PIV Auth
- A MacOS keychain cert per their docs - when into slot 9d Key Management
- Another auth certificate for "orion-admin" - went into slot 82

I'm able to authenticate on Windows as either orion or orion-admin, but on
Linux with sssd it does not see the orion-admin certificate.  What needs to
happen to support this?

Thanks!

-- 
Orion Poplawski
Manager of NWRA Technical Systems          720-772-5637
NWRA, Boulder/CoRA Office             FAX: [phone]
3380 Mitchell Lane                       orion(a)nwra.com
Boulder, CO 80301                 https://www.nwra.com/

[Sumit Bose]

On Wed, Nov 28, 2018 at 04:57:17PM -0700, Orion Poplawski wrote:
>  I configured a YubiKey on Windows using the YubiKey minidriver with
> the
>  following certificates:
>  
>  - my "orion" certificate - went into slot 9a PIV Auth
>  - A MacOS keychain cert per their docs - when into slot 9d Key Management
>  - Another auth certificate for "orion-admin" - went into slot 82
>  
>  I'm able to authenticate on Windows as either orion or orion-admin, but on
>  Linux with sssd it does not see the orion-admin certificate.  What needs to
>  happen to support this? 
Which version of SSSD are you using?

Can you sent the output of 

    p11tool  --list-all --provider opensc-pkcs11.so

and

    /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre

(in case you use a very recent OpenSSL build of SSSD please use
'--nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem' or the place where your CA
certifcates are stored).

bye,
Sumit

> 
> Thanks!
> 
> -- 
> Orion Poplawski
> Manager of NWRA Technical Systems          720-772-5637
> NWRA, Boulder/CoRA Office             FAX: [phone]
> 3380 Mitchell Lane                       orion(a)nwra.com
> Boulder, CO 80301                 https://www.nwra.com/
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...

[Orion Poplawski]

On 11/28/18 11:29 PM, Sumit Bose wrote:
>  On Wed, Nov 28, 2018 at 04:57:17PM -0700, Orion Poplawski wrote:
> > I configured a YubiKey on Windows using the YubiKey minidriver with the
> > following certificates:
> >
> > - my "orion" certificate - went into slot 9a PIV Auth
> > - A MacOS keychain cert per their docs - when into slot 9d Key Management
> > - Another auth certificate for "orion-admin" - went into slot 82
> >
> > I'm able to authenticate on Windows as either orion or orion-admin, but on
> > Linux with sssd it does not see the orion-admin certificate.  What needs to
> > happen to support this?
>  
>  Which version of SSSD are you using?
>  
sssd-1.16.2-13.el7_5

>  Can you sent the output of 
>  
>      p11tool  --list-all --provider opensc-pkcs11.so
>  
>  
$ p11tool  --list-all --provider /usr/lib64/opensc-pkcs11.so
Object 0:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%01;object=PIV%20AUTH%20pubkey;type=public
        Type: Public key
        Label: PIV AUTH pubkey
        Flags: CKA_WRAP/UNWRAP;
        ID: 01

Object 1:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%01;object=Certificate%20for%20PIV%20Authentication;type=cert
        Type: X.509 Certificate
        Label: Certificate for PIV Authentication
        ID: 01

Object 2:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%03;object=KEY%20MAN%20pubkey;type=public
        Type: Public key
        Label: KEY MAN pubkey
        ID: 03

Object 3:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%03;object=Certificate%20for%20Key%20Management;type=cert
        Type: X.509 Certificate
        Label: Certificate for Key Management
        ID: 03

Object 4:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Card%20Capability%20Container;type=data
        Type: Data
        Label: Card Capability Container
        ID:

Object 5:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Card%20Holder%20Unique%20Identifier;type=data
        Type: Data
        Label: Card Holder Unique Identifier
        ID:

Object 6:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Unsigned%20Card%20Holder%20Unique%20Identifier;type=data
        Type: Data
        Label: Unsigned Card Holder Unique Identifier
        ID:

Object 7:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20PIV%20Authentication;type=data
        Type: Data
        Label: X.509 Certificate for PIV Authentication
        ID:

Object 8:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20Digital%20Signature;type=data
        Type: Data
        Label: X.509 Certificate for Digital Signature
        ID:

Object 9:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20Key%20Management;type=data
        Type: Data
        Label: X.509 Certificate for Key Management
        ID:

Object 10:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20Card%20Authentication;type=data
        Type: Data
        Label: X.509 Certificate for Card Authentication
        ID:

Object 11:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Security%20Object;type=data
        Type: Data
        Label: Security Object
        ID:

Object 12:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Discovery%20Object;type=data
        Type: Data
        Label: Discovery Object
        ID:


>  and
>  
>      /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
>  
$ /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
(Thu Nov 29 13:31:29:125830 2018) [[sssd[p11_child[2569]]]] [main] (0x0400):
p11_child started.
(Thu Nov 29 13:31:29:126388 2018) [[sssd[p11_child[2569]]]] [main] (0x2000):
Running in [pre-auth] mode.
(Thu Nov 29 13:31:29:126426 2018) [[sssd[p11_child[2569]]]] [main] (0x2000):
Running with effective IDs: [22603][22603].
(Thu Nov 29 13:31:29:126459 2018) [[sssd[p11_child[2569]]]] [main] (0x2000):
Running with real IDs [22603][22603].
(Thu Nov 29 13:31:29:341356 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Default Module List:
(Thu Nov 29 13:31:29:341396 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): common name: [NSS Internal PKCS #11 Module].
(Thu Nov 29 13:31:29:341415 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): dll name: [(null)].
(Thu Nov 29 13:31:29:341433 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): common name: [OpenSC].
(Thu Nov 29 13:31:29:341451 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): dll name: [/usr/lib64/opensc-pkcs11.so].
(Thu Nov 29 13:31:29:341468 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Dead Module List:
(Thu Nov 29 13:31:29:341485 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): DB Module List:
(Thu Nov 29 13:31:29:341503 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): common name: [NSS Internal Module].
(Thu Nov 29 13:31:29:341520 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): dll name: [(null)].
(Thu Nov 29 13:31:29:341537 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): common name: [Policy File].
(Thu Nov 29 13:31:29:341554 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): dll name: [(null)].
(Thu Nov 29 13:31:29:367703 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Description [NSS User Private Key and Certificate Services
        Mozilla Foundation              ] Manufacturer [Mozilla Foundation
         ] flags [1].
(Thu Nov 29 13:31:29:367790 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Description [NSS Internal Cryptographic Services
        Mozilla Foundation                    ] Manufacturer [Mozilla
Foundation                 ] flags [9].
(Thu Nov 29 13:31:29:368358 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Description [Yubico Yubikey 4 OTP+U2F+CCID 00 00
        Yubico                          ] Manufacturer [Yubico
         ] flags [7].
(Thu Nov 29 13:31:29:368416 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Found [Orion Poplawski] in slot [Yubico Yubikey 4 OTP+U2F+CCID 00
00][0] of module [2][/usr/lib64/opensc-pkcs11.so].
(Thu Nov 29 13:31:29:368455 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Token is NOT friendly.
(Thu Nov 29 13:31:29:368488 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Trying to switch to friendly to read certificate.
(Thu Nov 29 13:31:29:368517 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Login required.
(Thu Nov 29 13:31:29:368544 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x0020): Login required but no PIN available, continue.
(Thu Nov 29 13:31:29:369245 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): found cert[Orion Poplawski:Certificate for PIV
Authentication][CN=Orion Poplawski,OU=NWRA,DC=ad,DC=nwra,DC=com]
(Thu Nov 29 13:31:29:369296 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): found cert[Orion Poplawski:Certificate for Key Management][CN=Orion
Poplawski,OU=NWRA,DC=ad,DC=nwra,DC=com]
(Thu Nov 29 13:31:29:369332 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Filtered certificates:
(Thu Nov 29 13:31:29:369364 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): found cert[Orion Poplawski:Certificate for PIV
Authentication][CN=Orion Poplawski,OU=NWRA,DC=ad,DC=nwra,DC=com]
(Thu Nov 29 13:31:29:370948 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): (null) /usr/lib64/opensc-pkcs11.so (null) Orion Poplawski (null) (null).
(Thu Nov 29 13:31:29:371002 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): found cert[Orion Poplawski:Certificate for Key Management][CN=Orion
Poplawski,OU=NWRA,DC=ad,DC=nwra,DC=com]
(Thu Nov 29 13:31:29:371049 2018) [[sssd[p11_child[2569]]]] [do_verification]
(0x0040): Certificate [Orion Poplawski:Certificate for Key
Management][CN=Orion Poplawski,OU=NWRA,DC=ad,DC=nwra,DC=com] not valid
[-8102][Certificate key usage inadequate for attempted operation.].
(Thu Nov 29 13:31:29:371109 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x0040): Certificate [Orion Poplawski:Certificate for Key
Management][CN=Orion Poplawski,OU=NWRA,DC=ad,DC=nwra,DC=com] not valid, skipping.
(Thu Nov 29 13:31:29:430991 2018) [[sssd[p11_child[2569]]]] [do_card]
(0x4000): Found certificate has key id [01].
Orion Poplawski
/usr/lib64/opensc-pkcs11.so
01
Certificate for PIV Authentication
MIIH5TCCBc2gAwIBAgITdgAAAczbsI5xA5LqwgAAAAABzDANBgkqhkiG9w0BAQ0FADBcMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMRswGQYDVQQDExJhZC1BRC1TRUFUVExFMDEtQ0EwHhcNMTgxMTIxMTc1MjA4WhcNMjAxMTIxMTgwMjA4WjBoMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMQ0wCwYDVQQLEwROV1JBMRgwFgYDVQQDEw9PcmlvbiBQb3BsYXdza2kwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0rbm0RJlpt16T8hM4TJauyh+1pQZI6tzlMPMAvljpo52KNXof9zf5z21kn+fmWmESkuHi32Ddzx5u+QoOu7YngDa+Ek/vfMpoLCpc2ioyJTXyOSArj3PLllNzSRewm5LJYxhKYqz7PegfTR9m0+NpNYh6vOIm9rzLFmG5+MZJdkv8zwZoIYbcON+ZAZDczGxinTSU5qK/G8c20CdDJbNyu+YWnd2B0owhgXlq7faddG/aXEpIT3FDJtTcX0EjHLyh1Zr2IIZiMvRlRLdTl2Kq4ujNYJcYSiQGkAfXo5KEyC2iZh5k2m+7qyE7v82m+MXUdVtcFtuw4fTj1edSnOBvAgMBAAGjggOSMIIDjjA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiD5Jojg6WiQ4GNnRCBnuAagaqGBoEywalyhtXJewIBZAIBBTAfBgNVHSUEGDAWBgorBgEEAYI3FAICBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwKQYJKwYBBAGCNxUKBBwwGjAMBgorBgEEAYI3FAICMAoGCCsGAQUFBwMCMIGUBgkqhkiG9w0BCQ8EgYYwgYMwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBLTALBglghkgBZQMEARYwCwYJYIZIAWUDBAEZMAsGCWCGSAFlAwQBAjALBglghkgBZQMEAQUwCgYIKoZIhvcNAwcwBwYFKw4DAgcwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgICADAdBgNVHQ4EFgQUrBhZaZYc5ALsWmG+76SqDPYr4cIwHwYDVR0jBBgwFoAUfNJMaZA8k520zkPFvv5Hfl4MDTkwggEgBgNVHR8EggEXMIIBEzCCAQ+gggELoIIBB4ZBaHR0cDovL0FELVNFQVRUTEUwMS5hZC5ud3JhLmNvbS9DZXJ0RW5yb2xsL2FkLUFELVNFQVRUTEUwMS1DQS5jcmyGgcFsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BRC1TRUFUVExFMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9YWQsREM9bndyYSxEQz1jb20/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHHBggrBgEFBQcBAQSBujCBtzCBtAYIKwYBBQUHMAKGgadsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1hZCxEQz1ud3JhLERDPWNvbT9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAsBgNVHREEJTAjoCEGCisGAQQBgjcUAgOgEwwRb3Jpb25AYWQubndyYS5jb20wDQYJKoZIhvcNAQENBQADggIBAJLuzfAPsiBf9VLIbevGMYRDoG0IgArZVSpd9LtW8gGjvta6zPfq9WrGGzPu8fclNE8PHVeV8YnkJpLFyu4Z8PjUwZZrN4Jt//yTxuMMa2srE5VEtnqulb/Hmyh5PKBTeN2HdDnX5o85btZruAvazfv3N8gmlQWOrkPWWW83uQKoritnpA+20hkQc6P6ojt51ViYZQKMpp+nCbjBKZ8ybWL0zwIM9Hd0iHFp2ZhuuQz5UpzuVGPgI4zu8CyVo3gfP2N1e8dBHz/OGtNDU3sXHEMjSay1EP2A+eKYelRQq0Dh2fs78AUEaOMaimgX24d7gH6WiuPjgfUxLy4DP7qq/aFpjEeDJo0IplfY4RxGSUe63GivmGGOGXklcq6ZU8aycY2C8QJtLmfAD7SKhzxmwScb9MKM0U4naP25VzOheE6V6e2RN4pGA5h9PJyI5+/Pbf82FuLsq4mVOjmLcD7gzSdjkMbysoqz/gLbhytDJ4Eh8FTg3YncqXWb4r8gcRKBZXuoLCrGDliYaHsJFsbAsX7vJ0Tp1DnvX7wWGXWGDxHtPRetmtq+cauKeHIXmSI3R7zueMDL2Gt3089NBJh/Hp2qAWwShR3TuO2tffConFJS9LLX5SBlNA2Lkybxsh/FAbPjFbzC5oCeGO0g5zuaago7WEm4CuiLQtvfimO9GNKe

And just for comparison:

$ yubico-piv-tool -a status
CHUID:
3019d4e739da739ced39ce739d836858210842108421384210c3f53410072180727c4b0c30d75c91b27c25efbd350832303330303130313e00fe00
CCC:
f015a000000116ff022b6532e39b0c782d8ec7b26efca5f10121f20121f300f40100f50110f600f700fa00fb00fc00fd00fe00
Slot 9a:
        Algorithm:      RSA2048
        Subject DN:     DC=com, DC=nwra, DC=ad, OU=NWRA, CN=Orion Poplawski
        Issuer DN:      DC=com, DC=nwra, DC=ad, CN=ad-AD-SEATTLE01-CA
        Fingerprint:
5a73f59cc4e93ef40012aedf0268abd0cf8fd260fbb243563f56271edf9fc99f
        Not Before:     Nov 21 17:52:08 2018 GMT
        Not After:      Nov 21 18:02:08 2020 GMT
Slot 9d:
        Algorithm:      RSA2048
        Subject DN:     DC=com, DC=nwra, DC=ad, OU=NWRA, CN=Orion Poplawski
        Issuer DN:      DC=com, DC=nwra, DC=ad, CN=ad-AD-SEATTLE01-CA
        Fingerprint:
9c6ae38156c501a4ef033dd54e509053dbf06640f6f6b5d5fcaeced20c815290
        Not Before:     Nov 21 17:52:39 2018 GMT
        Not After:      Nov 21 18:02:39 2020 GMT
Slot 82:
        Algorithm:      RSA2048
        Subject DN:     DC=com, DC=nwra, DC=ad, OU=NWRA, OU=Admin-Accounts,
CN=Orion Poplawski
        Issuer DN:      DC=com, DC=nwra, DC=ad, CN=ad-AD-SEATTLE01-CA
        Fingerprint:
8565497be7c56c7595ee7389d7781b8830fe5f110917ee2b16227e831c164b00
        Not Before:     Nov 21 18:10:10 2018 GMT
        Not After:      Nov 21 18:20:10 2020 GMT

>  
>  (in case you use a very recent OpenSSL build of SSSD please use
>  '--nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem' or the place where your CA
>  certifcates are stored).
>  
>  
I'll try to run this on a Fedora system as well....

>  bye,
>  Sumit
>  
> >
> > Thanks!
> >
> > -- 
> > Orion Poplawski
> > Manager of NWRA Technical Systems          720-772-5637
> > NWRA, Boulder/CoRA Office             FAX: [phone]
> > 3380 Mitchell Lane                       orion(a)nwra.com
> > Boulder, CO 80301                 https://www.nwra.com/
> > _______________________________________________
> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  
>  

-- 
Orion Poplawski
Manager of NWRA Technical Systems          720-772-5637
NWRA, Boulder/CoRA Office             FAX: [phone]
3380 Mitchell Lane                       orion(a)nwra.com
Boulder, CO 80301                 https://www.nwra.com/

[Orion Poplawski]

On 11/28/18 11:29 PM, Sumit Bose wrote:
>  On Wed, Nov 28, 2018 at 04:57:17PM -0700, Orion Poplawski wrote:
> > I configured a YubiKey on Windows using the YubiKey minidriver with the
> > following certificates:
> >
> > - my "orion" certificate - went into slot 9a PIV Auth
> > - A MacOS keychain cert per their docs - when into slot 9d Key Management
> > - Another auth certificate for "orion-admin" - went into slot 82
> >
> > I'm able to authenticate on Windows as either orion or orion-admin, but on
> > Linux with sssd it does not see the orion-admin certificate.  What needs to
> > happen to support this?
>  
>  Which version of SSSD are you using?
>  
On F29:

sssd-2.0.0-4.fc29.x86_64

I get somewhat different behavior.  First the gdm login screen presents two
certificates:

 - Certificate for Key Management
 - Certificate for PIV Authentication

but still does not list the admin cert.  Also, I don't believe it should list
the Key Management cert because it is not flagged for smart card authentication.


>  Can you sent the output of 
>  
>      p11tool  --list-all --provider opensc-pkcs11.so
>  
# p11tool  --list-all --provider opensc-pkcs11.so
Object 0:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%01;object=PIV%20AUTH%20pubkey;type=public
        Type: Public key (RSA-2048)
        Label: PIV AUTH pubkey
        Flags: CKA_WRAP/UNWRAP;
        ID: 01

Object 1:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%01;object=Certificate%20for%20PIV%20Authentication;type=cert
        Type: X.509 Certificate (RSA-2048)
        Expires: Sat Nov 21 11:02:08 2020
        Label: Certificate for PIV Authentication
        ID: 01

Object 2:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%03;object=KEY%20MAN%20pubkey;type=public
        Type: Public key (RSA-2048)
        Label: KEY MAN pubkey
        Flags: CKA_WRAP/UNWRAP;
        ID: 03

Object 3:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%03;object=Certificate%20for%20Key%20Management;type=cert
        Type: X.509 Certificate (RSA-2048)
        Expires: Sat Nov 21 11:02:39 2020
        Label: Certificate for Key Management
        ID: 03

Object 4:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Card%20Capability%20Container;type=data
        Type: Data
        Label: Card Capability Container
        ID:

Object 5:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Card%20Holder%20Unique%20Identifier;type=data
        Type: Data
        Label: Card Holder Unique Identifier
        ID:

Object 6:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Unsigned%20Card%20Holder%20Unique%20Identifier;type=data
        Type: Data
        Label: Unsigned Card Holder Unique Identifier
        ID:

Object 7:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20PIV%20Authentication;type=data
        Type: Data
        Label: X.509 Certificate for PIV Authentication
        ID:

Object 8:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20Digital%20Signature;type=data
        Type: Data
        Label: X.509 Certificate for Digital Signature
        ID:

Object 9:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20Key%20Management;type=data
        Type: Data
        Label: X.509 Certificate for Key Management
        ID:

Object 10:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20Card%20Authentication;type=data
        Type: Data
        Label: X.509 Certificate for Card Authentication
        ID:

Object 11:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Security%20Object;type=data
        Type: Data
        Label: Security Object
        ID:

Object 12:
        URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Discovery%20Object;type=data
        Type: Data
        Label: Discovery Object
        ID:


>  
>  and
>  
>      /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
>  
>  (in case you use a very recent OpenSSL build of SSSD please use
>  '--nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem' or the place where your CA
>  certifcates are stored).
>  
>  
# /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
(Thu Nov 29 14:01:57:597372 2018) [[sssd[p11_child[3338]]]] [main] (0x0400):
p11_child started.
(Thu Nov 29 14:01:57:597666 2018) [[sssd[p11_child[3338]]]] [main] (0x2000):
Running in [pre-auth] mode.
(Thu Nov 29 14:01:57:597858 2018) [[sssd[p11_child[3338]]]] [main] (0x2000):
Running with effective IDs: [0][0].
(Thu Nov 29 14:01:57:598246 2018) [[sssd[p11_child[3338]]]] [main] (0x2000):
Running with real IDs [0][0].
(Thu Nov 29 14:01:57:601833 2018) [[sssd[p11_child[3338]]]]
[init_verification] (0x0040): X509_LOOKUP_load_file failed
[185090184][error:0B084088:x509 certificate
routines:X509_load_cert_crl_file:no certificate or crl found].
(Thu Nov 29 14:01:57:602056 2018) [[sssd[p11_child[3338]]]] [do_work]
(0x0040): init_verification failed.
(Thu Nov 29 14:01:57:602358 2018) [[sssd[p11_child[3338]]]] [main] (0x0040):
do_work failed.
(Thu Nov 29 14:01:57:602651 2018) [[sssd[p11_child[3338]]]] [main] (0x0020):
p11_child failed!
root(a)vmf29.cora.nwra.com [~]# /usr/libexec/sssd/p11_child -d 10 --debug-fd=1
--nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem --pre
(Thu Nov 29 14:02:14:096983 2018) [[sssd[p11_child[3376]]]] [main] (0x0400):
p11_child started.
(Thu Nov 29 14:02:14:097325 2018) [[sssd[p11_child[3376]]]] [main] (0x2000):
Running in [pre-auth] mode.
(Thu Nov 29 14:02:14:097558 2018) [[sssd[p11_child[3376]]]] [main] (0x2000):
Running with effective IDs: [0][0].
(Thu Nov 29 14:02:14:097815 2018) [[sssd[p11_child[3376]]]] [main] (0x2000):
Running with real IDs [0][0].
(Thu Nov 29 14:02:14:520623 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): Module List:
(Thu Nov 29 14:02:14:520694 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): common name: [p11-kit-trust].
(Thu Nov 29 14:02:14:520704 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): dll name: [/usr/lib64/pkcs11/p11-kit-trust.so].
(Thu Nov 29 14:02:14:520735 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): Description [/etc/pki/ca-trust/source
        PKCS#11 Kit                     ] Manufacturer [PKCS#11 Kit
         ] flags [1] removable [false] token present [true].
(Thu Nov 29 14:02:14:520753 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): Description [/usr/share/pki/ca-trust-source
        PKCS#11 Kit                     ] Manufacturer [PKCS#11 Kit
         ] flags [1] removable [false] token present [true].
(Thu Nov 29 14:02:14:520764 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): common name: [opensc].
(Thu Nov 29 14:02:14:520771 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): dll name: [/usr/lib64/pkcs11/opensc-pkcs11.so].
(Thu Nov 29 14:02:14:521689 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): Description [Yubico Yubikey 4 OTP+U2F+CCID 00 00
        Yubico                          ] Manufacturer [Yubico
         ] flags [7] removable [true] token present [true].
(Thu Nov 29 14:02:14:538790 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): Found [Orion Poplawski] in slot [Yubico Yubikey 4 OTP+U2F+CCID 00
00][0] of module [1][/usr/lib64/pkcs11/opensc-pkcs11.so].
(Thu Nov 29 14:02:14:538824 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): Login NOT required.
(Thu Nov 29 14:02:14:539066 2018) [[sssd[p11_child[3376]]]] [read_certs]
(0x4000): found cert[Certificate for PIV
Authentication][/DC=com/DC=nwra/DC=ad/OU=NWRA/CN=Orion Poplawski]
(Thu Nov 29 14:02:14:539770 2018) [[sssd[p11_child[3376]]]] [do_ocsp]
(0x0020): No OCSP URL in certificate and no default responder defined,
skipping OCSP check.
(Thu Nov 29 14:02:14:539891 2018) [[sssd[p11_child[3376]]]] [read_certs]
(0x4000): found cert[Certificate for Key
Management][/DC=com/DC=nwra/DC=ad/OU=NWRA/CN=Orion Poplawski]
(Thu Nov 29 14:02:14:540279 2018) [[sssd[p11_child[3376]]]] [do_ocsp]
(0x0020): No OCSP URL in certificate and no default responder defined,
skipping OCSP check.
(Thu Nov 29 14:02:14:540299 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): (null) /usr/lib64/pkcs11/opensc-pkcs11.so (null) Orion Poplawski
(null) 03.
(Thu Nov 29 14:02:14:540308 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): (null) /usr/lib64/pkcs11/opensc-pkcs11.so (null) Orion Poplawski
(null) 01.
(Thu Nov 29 14:02:14:540377 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): uri:
pkcs11:library-description=OpenSC%20smartcard%20framework;library-manufacturer=OpenSC%20Project;library-version=0.19;slot-description=Yubico%20Yubikey%204%20OTP%2bU2F%2bCCID%2000%2000;slot-manufacturer=Yubico;slot-id=0;model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%01;object=Certificate%20for%20PIV%20Authentication;type=cert.
(Thu Nov 29 14:02:14:540417 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): uri:
pkcs11:library-description=OpenSC%20smartcard%20framework;library-manufacturer=OpenSC%20Project;library-version=0.19;slot-description=Yubico%20Yubikey%204%20OTP%2bU2F%2bCCID%2000%2000;slot-manufacturer=Yubico;slot-id=0;model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%03;object=Certificate%20for%20Key%20Management;type=cert.
(Thu Nov 29 14:02:14:540430 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): Found certificate has key id [01].
(Thu Nov 29 14:02:14:540457 2018) [[sssd[p11_child[3376]]]] [do_card]
(0x4000): Found certificate has key id [03].
Orion Poplawski
/usr/lib64/pkcs11/opensc-pkcs11.so
01
Certificate for PIV Authentication
MIIH5TCCBc2gAwIBAgITdgAAAczbsI5xA5LqwgAAAAABzDANBgkqhkiG9w0BAQ0FADBcMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMRswGQYDVQQDExJhZC1BRC1TRUFUVExFMDEtQ0EwHhcNMTgxMTIxMTc1MjA4WhcNMjAxMTIxMTgwMjA4WjBoMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMQ0wCwYDVQQLEwROV1JBMRgwFgYDVQQDEw9PcmlvbiBQb3BsYXdza2kwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0rbm0RJlpt16T8hM4TJauyh+1pQZI6tzlMPMAvljpo52KNXof9zf5z21kn+fmWmESkuHi32Ddzx5u+QoOu7YngDa+Ek/vfMpoLCpc2ioyJTXyOSArj3PLllNzSRewm5LJYxhKYqz7PegfTR9m0+NpNYh6vOIm9rzLFmG5+MZJdkv8zwZoIYbcON+ZAZDczGxinTSU5qK/G8c20CdDJbNyu+YWnd2B0owhgXlq7faddG/aXEpIT3FDJtTcX0EjHLyh1Zr2IIZiMvRlRLdTl2Kq4ujNYJcYSiQGkAfXo5KEyC2iZh5k2m+7qyE7v82m+MXUdVtcFtuw4fTj1edSnOBvAgMBAAGjggOSMIIDjjA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiD5Jojg6WiQ4GNnRCBnuAagaqGBoEywalyhtXJewIBZAIBBTAfBgNVHSUEGDAWBgorBgEEAYI3FAICBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwKQYJKwYBBAGCNxUKBBwwGjAMBgorBgEEAYI3FAICMAoGCCsGAQUFBwMCMIGUBgkqhkiG9w0BCQ8EgYYwgYMwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBLTALBglghkgBZQMEARYwCwYJYIZIAWUDBAEZMAsGCWCGSAFlAwQBAjALBglghkgBZQMEAQUwCgYIKoZIhvcNAwcwBwYFKw4DAgcwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgICADAdBgNVHQ4EFgQUrBhZaZYc5ALsWmG+76SqDPYr4cIwHwYDVR0jBBgwFoAUfNJMaZA8k520zkPFvv5Hfl4MDTkwggEgBgNVHR8EggEXMIIBEzCCAQ+gggELoIIBB4ZBaHR0cDovL0FELVNFQVRUTEUwMS5hZC5ud3JhLmNvbS9DZXJ0RW5yb2xsL2FkLUFELVNFQVRUTEUwMS1DQS5jcmyGgcFsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BRC1TRUFUVExFMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9YWQsREM9bndyYSxEQz1jb20/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHHBggrBgEFBQcBAQSBujCBtzCBtAYIKwYBBQUHMAKGgadsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1hZCxEQz1ud3JhLERDPWNvbT9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAsBgNVHREEJTAjoCEGCisGAQQBgjcUAgOgEwwRb3Jpb25AYWQubndyYS5jb20wDQYJKoZIhvcNAQENBQADggIBAJLuzfAPsiBf9VLIbevGMYRDoG0IgArZVSpd9LtW8gGjvta6zPfq9WrGGzPu8fclNE8PHVeV8YnkJpLFyu4Z8PjUwZZrN4Jt//yTxuMMa2srE5VEtnqulb/Hmyh5PKBTeN2HdDnX5o85btZruAvazfv3N8gmlQWOrkPWWW83uQKoritnpA+20hkQc6P6ojt51ViYZQKMpp+nCbjBKZ8ybWL0zwIM9Hd0iHFp2ZhuuQz5UpzuVGPgI4zu8CyVo3gfP2N1e8dBHz/OGtNDU3sXHEMjSay1EP2A+eKYelRQq0Dh2fs78AUEaOMaimgX24d7gH6WiuPjgfUxLy4DP7qq/aFpjEeDJo0IplfY4RxGSUe63GivmGGOGXklcq6ZU8aycY2C8QJtLmfAD7SKhzxmwScb9MKM0U4naP25VzOheE6V6e2RN4pGA5h9PJyI5+/Pbf82FuLsq4mVOjmLcD7gzSdjkMbysoqz/gLbhytDJ4Eh8FTg3YncqXWb4r8gcRKBZXuoLCrGDliYaHsJFsbAsX7vJ0Tp1DnvX7wWGXWGDxHtPRetmtq+cauKeHIXmSI3R7zueMDL2Gt3089NBJh/Hp2qAWwShR3TuO2tffConFJS9LLX5SBlNA2Lkybxsh/FAbPjFbzC5oCeGO0g5zuaago7WEm4CuiLQtvfimO9GNKe
Orion Poplawski
/usr/lib64/pkcs11/opensc-pkcs11.so
03
Certificate for Key Management
MIIH0DCCBbigAwIBAgITdgAAAc1+AMfS7zlhnwAAAAABzTANBgkqhkiG9w0BAQ0FADBcMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMRswGQYDVQQDExJhZC1BRC1TRUFUVExFMDEtQ0EwHhcNMTgxMTIxMTc1MjM5WhcNMjAxMTIxMTgwMjM5WjBoMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMQ0wCwYDVQQLEwROV1JBMRgwFgYDVQQDEw9PcmlvbiBQb3BsYXdza2kwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDT4bc6zf6EVUgyCqKYnMatK6qtiL+yjGnhHRl0nCoeN/TWmY47f23Nb/CjGW5W9T+i2jVM4HE2pijoEFcLQQnLkWQLSNeYQ+HKMY8kdmcT+aYDk5N5scDRKg5mIN1HaMqQqRYgXfgdlMh46u6kzVVHM+iuGnrHOTIV6b84PNHU3xLHidhqPZF6IRcuSmfLYGiKrQj2RuR0gD+19c1Gi2iupsMSCBAwJAukoY/gMK01n+srjIidgNT8lufajIA52b4w7GsYfQrByY9ChBH/tORRMaR6PDA7P6YIv0r6BlIvgTIeA4VOEXVFXtr8waY/WI3Lvn9oVeSBmu6Z6Owajl+3AgMBAAGjggN9MIIDeTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiD5Jojg6WiQ4GNnRCBnuAagaqGBoEyh6mmD4GZshECAWQCAQcwFQYDVR0lBA4wDAYKKwYBBAGCNwoDBDAOBgNVHQ8BAf8EBAMCBSAwHQYJKwYBBAGCNxUKBBAwDjAMBgorBgEEAYI3CgMEMIGUBgkqhkiG9w0BCQ8EgYYwgYMwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBLTALBglghkgBZQMEARYwCwYJYIZIAWUDBAEZMAsGCWCGSAFlAwQBAjALBglghkgBZQMEAQUwCgYIKoZIhvcNAwcwBwYFKw4DAgcwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgICADAdBgNVHQ4EFgQULZA/coMUaYGWcNN2uD+kmQ5ctP0wHwYDVR0jBBgwFoAUfNJMaZA8k520zkPFvv5Hfl4MDTkwggEgBgNVHR8EggEXMIIBEzCCAQ+gggELoIIBB4ZBaHR0cDovL0FELVNFQVRUTEUwMS5hZC5ud3JhLmNvbS9DZXJ0RW5yb2xsL2FkLUFELVNFQVRUTEUwMS1DQS5jcmyGgcFsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BRC1TRUFUVExFMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9YWQsREM9bndyYSxEQz1jb20/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHHBggrBgEFBQcBAQSBujCBtzCBtAYIKwYBBQUHMAKGgadsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1hZCxEQz1ud3JhLERDPWNvbT9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAsBgNVHREEJTAjoCEGCisGAQQBgjcUAgOgEwwRb3Jpb25AYWQubndyYS5jb20wDQYJKoZIhvcNAQENBQADggIBAHAScbtpgzQJajb8HlAIhH05SxU51vjigvIu5LH5VBvuIuMlWsIbvo5k3vf7bkNUaJgrpl/6qzsXm4Y4hwv7C6EJL5PjClfMtj7R7HHfQFFtbmhdfJs2yvik7rU6NzHKdCQ16ZeG/J3ZMUpnjqLO2xBN6UYb/0zf8YjrHcIDHx/yQplsulKA76tTCJ5mtG7yodPqhIC7pfcusqHaK+XOPNyO5nL7N0uSOILcS5Z0dsUS/ZLz4nce1Wle46Ni/ybzt7uaJJwTABlb4ZkHE5Co1wy6yFUPe3YDSNB8JWetMCwtKBD5u5m2gGynfQNGTUW1CDtoLFSBvG0EKqjkeZpPsotbJK/475HJFLrsL78H6x588fc80fMQyBHR0o4kYn/Qv/AdS72ZocF10tn84UuTwqNOAJi8aKHd3D/1ztunH5HTTdimsZq1cNsYi/ZL3bojhhJS0AaPCjmpbTr0M7m4ZLtn6pmigCRbZEsUoO8qwUDt5D/aGOxORA6H9j/TzV1ER9n6h7kRRwFPn5zZXaAqzfl3dkQZIkjvYyNYaxkI5fBw5JFNLFRJNZdY9vyqGTbzUWl8pKOReWoSLK89IN2B/Mh2gwworha4SZ5ldNobMElNAXTYyh5T9QDk4Vl6sKN2kKhruKmz5vy+lxScQR1kAoxe2x58KEGyv3DhrsSLqUna

>  bye,
>  Sumit
>  
> >
> > Thanks!
> >
> > -- 
> > Orion Poplawski
> > Manager of NWRA Technical Systems          720-772-5637
> > NWRA, Boulder/CoRA Office             FAX: [phone]
> > 3380 Mitchell Lane                       orion(a)nwra.com
> > Boulder, CO 80301                 https://www.nwra.com/
> > _______________________________________________
> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  
>  

-- 
Orion Poplawski
Manager of NWRA Technical Systems          720-772-5637
NWRA, Boulder/CoRA Office             FAX: [phone]
3380 Mitchell Lane                       orion(a)nwra.com
Boulder, CO 80301                 https://www.nwra.com/

[Sumit Bose]

On Thu, Nov 29, 2018 at 02:03:09PM -0700, Orion Poplawski wrote:
>  On 11/28/18 11:29 PM, Sumit Bose wrote:
>  > On Wed, Nov 28, 2018 at 04:57:17PM -0700, Orion Poplawski wrote:
>  >> I configured a YubiKey on Windows using the YubiKey minidriver with the
>  >> following certificates:
>  >>
>  >> - my "orion" certificate - went into slot 9a PIV Auth
>  >> - A MacOS keychain cert per their docs - when into slot 9d Key Management
>  >> - Another auth certificate for "orion-admin" - went into slot 82
>  >>
>  >> I'm able to authenticate on Windows as either orion or orion-admin, but on
>  >> Linux with sssd it does not see the orion-admin certificate.  What needs to
>  >> happen to support this?
>  > 
>  > Which version of SSSD are you using?
>  
>  On F29:
>  
>  sssd-2.0.0-4.fc29.x86_64
>  
>  I get somewhat different behavior.  First the gdm login screen presents two
>  certificates:
>  
>   - Certificate for Key Management
>   - Certificate for PIV Authentication
>  
>  but still does not list the admin cert.  Also, I don't believe it should list
>  the Key Management cert because it is not flagged for smart card authentication. 
Do you mean the labels 'Certificate for PIV Authentication' and
'Certificate for Key Management' by 'flagged'?

SSSD only looks at the content of the certificate and by default uses
everything with key usage digitalSignature and extended key usage
clientAuth. With F29 you can modify this by adding mapping and matching
rules to sssd.conf, see the 'CERTIFICATE MAPPING SECTION' in man
sssd.conf for details.

>  
>  
>  > Can you sent the output of 
>  > 
>  >     p11tool  --list-all --provider opensc-pkcs11.so 
The slots for the retired keys are not visible. I've found
https://github.com/OpenSC/OpenSC/issues/847#issuecomment-238119888 with
a command which made the slots visible for PKCS#11 on my Yubikey.
Nevertheless the type is still data even after importing a certificate
with 'yubico-piv-tool -a import-certificate'. Maybe this is different
when using the Windows driver?

Since you already reached out to Yubico you might want to ask as well
what needs to be done to make the certificates and private keys stored
in the retired slots properly available as certificate and private key
on the PKCS#11 level.

bye,
Sumit

> 
> # p11tool  --list-all --provider opensc-pkcs11.so
> Object 0:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%01;object=PIV%20AUTH%20pubkey;type=public
>         Type: Public key (RSA-2048)
>         Label: PIV AUTH pubkey
>         Flags: CKA_WRAP/UNWRAP;
>         ID: 01
> 
> Object 1:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%01;object=Certificate%20for%20PIV%20Authentication;type=cert
>         Type: X.509 Certificate (RSA-2048)
>         Expires: Sat Nov 21 11:02:08 2020
>         Label: Certificate for PIV Authentication
>         ID: 01
> 
> Object 2:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%03;object=KEY%20MAN%20pubkey;type=public
>         Type: Public key (RSA-2048)
>         Label: KEY MAN pubkey
>         Flags: CKA_WRAP/UNWRAP;
>         ID: 03
> 
> Object 3:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%03;object=Certificate%20for%20Key%20Management;type=cert
>         Type: X.509 Certificate (RSA-2048)
>         Expires: Sat Nov 21 11:02:39 2020
>         Label: Certificate for Key Management
>         ID: 03
> 
> Object 4:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Card%20Capability%20Container;type=data
>         Type: Data
>         Label: Card Capability Container
>         ID:
> 
> Object 5:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Card%20Holder%20Unique%20Identifier;type=data
>         Type: Data
>         Label: Card Holder Unique Identifier
>         ID:
> 
> Object 6:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Unsigned%20Card%20Holder%20Unique%20Identifier;type=data
>         Type: Data
>         Label: Unsigned Card Holder Unique Identifier
>         ID:
> 
> Object 7:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20PIV%20Authentication;type=data
>         Type: Data
>         Label: X.509 Certificate for PIV Authentication
>         ID:
> 
> Object 8:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20Digital%20Signature;type=data
>         Type: Data
>         Label: X.509 Certificate for Digital Signature
>         ID:
> 
> Object 9:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20Key%20Management;type=data
>         Type: Data
>         Label: X.509 Certificate for Key Management
>         ID:
> 
> Object 10:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=X.509%20Certificate%20for%20Card%20Authentication;type=data
>         Type: Data
>         Label: X.509 Certificate for Card Authentication
>         ID:
> 
> Object 11:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Security%20Object;type=data
>         Type: Data
>         Label: Security Object
>         ID:
> 
> Object 12:
>         URL:
>
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;object=Discovery%20Object;type=data
>         Type: Data
>         Label: Discovery Object
>         ID:
> 
> 
> > 
> > and
> > 
> >     /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
> > 
> > (in case you use a very recent OpenSSL build of SSSD please use
> > '--nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem' or the place where your CA
> > certifcates are stored).
> > 
> 
> # /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
> (Thu Nov 29 14:01:57:597372 2018) [[sssd[p11_child[3338]]]] [main] (0x0400):
> p11_child started.
> (Thu Nov 29 14:01:57:597666 2018) [[sssd[p11_child[3338]]]] [main] (0x2000):
> Running in [pre-auth] mode.
> (Thu Nov 29 14:01:57:597858 2018) [[sssd[p11_child[3338]]]] [main] (0x2000):
> Running with effective IDs: [0][0].
> (Thu Nov 29 14:01:57:598246 2018) [[sssd[p11_child[3338]]]] [main] (0x2000):
> Running with real IDs [0][0].
> (Thu Nov 29 14:01:57:601833 2018) [[sssd[p11_child[3338]]]]
> [init_verification] (0x0040): X509_LOOKUP_load_file failed
> [185090184][error:0B084088:x509 certificate
> routines:X509_load_cert_crl_file:no certificate or crl found].
> (Thu Nov 29 14:01:57:602056 2018) [[sssd[p11_child[3338]]]] [do_work]
> (0x0040): init_verification failed.
> (Thu Nov 29 14:01:57:602358 2018) [[sssd[p11_child[3338]]]] [main] (0x0040):
> do_work failed.
> (Thu Nov 29 14:01:57:602651 2018) [[sssd[p11_child[3338]]]] [main] (0x0020):
> p11_child failed!
> root(a)vmf29.cora.nwra.com [~]# /usr/libexec/sssd/p11_child -d 10 --debug-fd=1
> --nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem --pre
> (Thu Nov 29 14:02:14:096983 2018) [[sssd[p11_child[3376]]]] [main] (0x0400):
> p11_child started.
> (Thu Nov 29 14:02:14:097325 2018) [[sssd[p11_child[3376]]]] [main] (0x2000):
> Running in [pre-auth] mode.
> (Thu Nov 29 14:02:14:097558 2018) [[sssd[p11_child[3376]]]] [main] (0x2000):
> Running with effective IDs: [0][0].
> (Thu Nov 29 14:02:14:097815 2018) [[sssd[p11_child[3376]]]] [main] (0x2000):
> Running with real IDs [0][0].
> (Thu Nov 29 14:02:14:520623 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): Module List:
> (Thu Nov 29 14:02:14:520694 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): common name: [p11-kit-trust].
> (Thu Nov 29 14:02:14:520704 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): dll name: [/usr/lib64/pkcs11/p11-kit-trust.so].
> (Thu Nov 29 14:02:14:520735 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): Description [/etc/pki/ca-trust/source
>         PKCS#11 Kit                     ] Manufacturer [PKCS#11 Kit
>          ] flags [1] removable [false] token present [true].
> (Thu Nov 29 14:02:14:520753 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): Description [/usr/share/pki/ca-trust-source
>         PKCS#11 Kit                     ] Manufacturer [PKCS#11 Kit
>          ] flags [1] removable [false] token present [true].
> (Thu Nov 29 14:02:14:520764 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): common name: [opensc].
> (Thu Nov 29 14:02:14:520771 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): dll name: [/usr/lib64/pkcs11/opensc-pkcs11.so].
> (Thu Nov 29 14:02:14:521689 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): Description [Yubico Yubikey 4 OTP+U2F+CCID 00 00
>         Yubico                          ] Manufacturer [Yubico
>          ] flags [7] removable [true] token present [true].
> (Thu Nov 29 14:02:14:538790 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): Found [Orion Poplawski] in slot [Yubico Yubikey 4 OTP+U2F+CCID 00
> 00][0] of module [1][/usr/lib64/pkcs11/opensc-pkcs11.so].
> (Thu Nov 29 14:02:14:538824 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): Login NOT required.
> (Thu Nov 29 14:02:14:539066 2018) [[sssd[p11_child[3376]]]] [read_certs]
> (0x4000): found cert[Certificate for PIV
> Authentication][/DC=com/DC=nwra/DC=ad/OU=NWRA/CN=Orion Poplawski]
> (Thu Nov 29 14:02:14:539770 2018) [[sssd[p11_child[3376]]]] [do_ocsp]
> (0x0020): No OCSP URL in certificate and no default responder defined,
> skipping OCSP check.
> (Thu Nov 29 14:02:14:539891 2018) [[sssd[p11_child[3376]]]] [read_certs]
> (0x4000): found cert[Certificate for Key
> Management][/DC=com/DC=nwra/DC=ad/OU=NWRA/CN=Orion Poplawski]
> (Thu Nov 29 14:02:14:540279 2018) [[sssd[p11_child[3376]]]] [do_ocsp]
> (0x0020): No OCSP URL in certificate and no default responder defined,
> skipping OCSP check.
> (Thu Nov 29 14:02:14:540299 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): (null) /usr/lib64/pkcs11/opensc-pkcs11.so (null) Orion Poplawski
> (null) 03.
> (Thu Nov 29 14:02:14:540308 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): (null) /usr/lib64/pkcs11/opensc-pkcs11.so (null) Orion Poplawski
> (null) 01.
> (Thu Nov 29 14:02:14:540377 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): uri:
>
pkcs11:library-description=OpenSC%20smartcard%20framework;library-manufacturer=OpenSC%20Project;library-version=0.19;slot-description=Yubico%20Yubikey%204%20OTP%2bU2F%2bCCID%2000%2000;slot-manufacturer=Yubico;slot-id=0;model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%01;object=Certificate%20for%20PIV%20Authentication;type=cert.
> (Thu Nov 29 14:02:14:540417 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): uri:
>
pkcs11:library-description=OpenSC%20smartcard%20framework;library-manufacturer=OpenSC%20Project;library-version=0.19;slot-description=Yubico%20Yubikey%204%20OTP%2bU2F%2bCCID%2000%2000;slot-manufacturer=Yubico;slot-id=0;model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%03;object=Certificate%20for%20Key%20Management;type=cert.
> (Thu Nov 29 14:02:14:540430 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): Found certificate has key id [01].
> (Thu Nov 29 14:02:14:540457 2018) [[sssd[p11_child[3376]]]] [do_card]
> (0x4000): Found certificate has key id [03].
> Orion Poplawski
> /usr/lib64/pkcs11/opensc-pkcs11.so
> 01
> Certificate for PIV Authentication
>
MIIH5TCCBc2gAwIBAgITdgAAAczbsI5xA5LqwgAAAAABzDANBgkqhkiG9w0BAQ0FADBcMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMRswGQYDVQQDExJhZC1BRC1TRUFUVExFMDEtQ0EwHhcNMTgxMTIxMTc1MjA4WhcNMjAxMTIxMTgwMjA4WjBoMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMQ0wCwYDVQQLEwROV1JBMRgwFgYDVQQDEw9PcmlvbiBQb3BsYXdza2kwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0rbm0RJlpt16T8hM4TJauyh+1pQZI6tzlMPMAvljpo52KNXof9zf5z21kn+fmWmESkuHi32Ddzx5u+QoOu7YngDa+Ek/vfMpoLCpc2ioyJTXyOSArj3PLllNzSRewm5LJYxhKYqz7PegfTR9m0+NpNYh6vOIm9rzLFmG5+MZJdkv8zwZoIYbcON+ZAZDczGxinTSU5qK/G8c20CdDJbNyu+YWnd2B0owhgXlq7faddG/aXEpIT3FDJtTcX0EjHLyh1Zr2IIZiMvRlRLdTl2Kq4ujNYJcYSiQGkAfXo5KEyC2iZh5k2m+7qyE7v82m+MXUdVtcFtuw4fTj1edSnOBvAgMBAAGjggOSMIIDjjA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiD5Jojg6WiQ4GNnRCBnuAagaqGBoEywalyhtXJewIBZAIBBTAfBgNVHSUEGDAWBgorBgEEAYI3FAICBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwKQYJKwYBBAGCNxUKBBwwGjAMBgorBgEEAYI3FAICMAoGCCsGAQUFBwMCMIGUBgkqhkiG9w0BCQ8EgYYwgYMwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBLTALBglghkgBZQMEARYwCwYJYIZIAWUDBAEZMAsGCWCGSAFlAwQBAjALBglghkgBZQMEAQUwCgYIKoZIhvcNAwcwBwYFKw4DAgcwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgICADAdBgNVHQ4EFgQUrBhZaZYc5ALsWmG+76SqDPYr4cIwHwYDVR0jBBgwFoAUfNJMaZA8k520zkPFvv5Hfl4MDTkwggEgBgNVHR8EggEXMIIBEzCCAQ+gggELoIIBB4ZBaHR0cDovL0FELVNFQVRUTEUwMS5hZC5ud3JhLmNvbS9DZXJ0RW5yb2xsL2FkLUFELVNFQVRUTEUwMS1DQS5jcmyGgcFsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BRC1TRUFUVExFMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9YWQsREM9bndyYSxEQz1jb20/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHHBggrBgEFBQcBAQSBujCBtzCBtAYIKwYBBQUHMAKGgadsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1hZCxEQz1ud3JhLERDPWNvbT9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAsBgNVHREEJTAjoCEGCisGAQQBgjcUAgOgEwwRb3Jpb25AYWQubndyYS5jb20wDQYJKoZIhvcNAQENBQADggIBAJLuzfAPsiBf9VLIbevGMYRDoG0IgArZVSpd9LtW8gGjvta6zPfq9WrGGzPu8fclNE8PHVeV8YnkJpLFyu4Z8PjUwZZrN4Jt//yTxuMMa2srE5VEtnqulb/Hmyh5PKBTeN2HdDnX5o85btZruAvazfv3N8gmlQWOrkPWWW83uQKoritnpA+20hkQc6P6ojt51ViYZQKMpp+nCbjBKZ8ybWL0zwIM9Hd0iHFp2ZhuuQz5UpzuVGPgI4zu8CyVo3gfP2N1e8dBHz/OGtNDU3sXHEMjSay1EP2A+eKYelRQq0Dh2fs78AUEaOMaimgX24d7gH6WiuPjgfUxLy4DP7qq/aFpjEeDJo0IplfY4RxGSUe63GivmGGOGXklcq6ZU8aycY2C8QJtLmfAD7SKhzxmwScb9MKM0U4naP25VzOheE6V6e2RN4pGA5h9PJyI5+/Pbf82FuLsq4mVOjmLcD7gzSdjkMbysoqz/gLbhytDJ4Eh8FTg3YncqXWb4r8gcRKBZXuoLCrGDliYaHsJFsbAsX7vJ0Tp1DnvX7wWGXWGDxHtPRetmtq+cauKeHIXmSI3R7zueMDL2Gt3089NBJh/Hp2qAWwShR3TuO2tffConFJS9LLX5SBlNA2Lkybxsh/FAbPjFbzC5oCeGO0g5zuaago7WEm4CuiLQtvfimO9GNKe
> Orion Poplawski
> /usr/lib64/pkcs11/opensc-pkcs11.so
> 03
> Certificate for Key Management
>
MIIH0DCCBbigAwIBAgITdgAAAc1+AMfS7zlhnwAAAAABzTANBgkqhkiG9w0BAQ0FADBcMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMRswGQYDVQQDExJhZC1BRC1TRUFUVExFMDEtQ0EwHhcNMTgxMTIxMTc1MjM5WhcNMjAxMTIxMTgwMjM5WjBoMRMwEQYKCZImiZPyLGQBGRYDY29tMRQwEgYKCZImiZPyLGQBGRYEbndyYTESMBAGCgmSJomT8ixkARkWAmFkMQ0wCwYDVQQLEwROV1JBMRgwFgYDVQQDEw9PcmlvbiBQb3BsYXdza2kwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDT4bc6zf6EVUgyCqKYnMatK6qtiL+yjGnhHRl0nCoeN/TWmY47f23Nb/CjGW5W9T+i2jVM4HE2pijoEFcLQQnLkWQLSNeYQ+HKMY8kdmcT+aYDk5N5scDRKg5mIN1HaMqQqRYgXfgdlMh46u6kzVVHM+iuGnrHOTIV6b84PNHU3xLHidhqPZF6IRcuSmfLYGiKrQj2RuR0gD+19c1Gi2iupsMSCBAwJAukoY/gMK01n+srjIidgNT8lufajIA52b4w7GsYfQrByY9ChBH/tORRMaR6PDA7P6YIv0r6BlIvgTIeA4VOEXVFXtr8waY/WI3Lvn9oVeSBmu6Z6Owajl+3AgMBAAGjggN9MIIDeTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiD5Jojg6WiQ4GNnRCBnuAagaqGBoEyh6mmD4GZshECAWQCAQcwFQYDVR0lBA4wDAYKKwYBBAGCNwoDBDAOBgNVHQ8BAf8EBAMCBSAwHQYJKwYBBAGCNxUKBBAwDjAMBgorBgEEAYI3CgMEMIGUBgkqhkiG9w0BCQ8EgYYwgYMwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBLTALBglghkgBZQMEARYwCwYJYIZIAWUDBAEZMAsGCWCGSAFlAwQBAjALBglghkgBZQMEAQUwCgYIKoZIhvcNAwcwBwYFKw4DAgcwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgICADAdBgNVHQ4EFgQULZA/coMUaYGWcNN2uD+kmQ5ctP0wHwYDVR0jBBgwFoAUfNJMaZA8k520zkPFvv5Hfl4MDTkwggEgBgNVHR8EggEXMIIBEzCCAQ+gggELoIIBB4ZBaHR0cDovL0FELVNFQVRUTEUwMS5hZC5ud3JhLmNvbS9DZXJ0RW5yb2xsL2FkLUFELVNFQVRUTEUwMS1DQS5jcmyGgcFsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BRC1TRUFUVExFMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9YWQsREM9bndyYSxEQz1jb20/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHHBggrBgEFBQcBAQSBujCBtzCBtAYIKwYBBQUHMAKGgadsZGFwOi8vL0NOPWFkLUFELVNFQVRUTEUwMS1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1hZCxEQz1ud3JhLERDPWNvbT9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAsBgNVHREEJTAjoCEGCisGAQQBgjcUAgOgEwwRb3Jpb25AYWQubndyYS5jb20wDQYJKoZIhvcNAQENBQADggIBAHAScbtpgzQJajb8HlAIhH05SxU51vjigvIu5LH5VBvuIuMlWsIbvo5k3vf7bkNUaJgrpl/6qzsXm4Y4hwv7C6EJL5PjClfMtj7R7HHfQFFtbmhdfJs2yvik7rU6NzHKdCQ16ZeG/J3ZMUpnjqLO2xBN6UYb/0zf8YjrHcIDHx/yQplsulKA76tTCJ5mtG7yodPqhIC7pfcusqHaK+XOPNyO5nL7N0uSOILcS5Z0dsUS/ZLz4nce1Wle46Ni/ybzt7uaJJwTABlb4ZkHE5Co1wy6yFUPe3YDSNB8JWetMCwtKBD5u5m2gGynfQNGTUW1CDtoLFSBvG0EKqjkeZpPsotbJK/475HJFLrsL78H6x588fc80fMQyBHR0o4kYn/Qv/AdS72ZocF10tn84UuTwqNOAJi8aKHd3D/1ztunH5HTTdimsZq1cNsYi/ZL3bojhhJS0AaPCjmpbTr0M7m4ZLtn6pmigCRbZEsUoO8qwUDt5D/aGOxORA6H9j/TzV1ER9n6h7kRRwFPn5zZXaAqzfl3dkQZIkjvYyNYaxkI5fBw5JFNLFRJNZdY9vyqGTbzUWl8pKOReWoSLK89IN2B/Mh2gwworha4SZ5ldNobMElNAXTYyh5T9QDk4Vl6sKN2kKhruKmz5vy+lxScQR1kAoxe2x58KEGyv3DhrsSLqUna
> 
> > bye,
> > Sumit
> > 
> >>
> >> Thanks!
> >>
> >> -- 
> >> Orion Poplawski
> >> Manager of NWRA Technical Systems          720-772-5637
> >> NWRA, Boulder/CoRA Office             FAX: [phone]
> >> 3380 Mitchell Lane                       orion(a)nwra.com
> >> Boulder, CO 80301                 https://www.nwra.com/
> >> _______________________________________________
> >> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> >> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> >> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> >> List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...
> > _______________________________________________
> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...
> > 
> 
> 
> -- 
> Orion Poplawski
> Manager of NWRA Technical Systems          720-772-5637
> NWRA, Boulder/CoRA Office             FAX: [phone]
> 3380 Mitchell Lane                       orion(a)nwra.com
> Boulder, CO 80301                 https://www.nwra.com/

[Orion Poplawski]

On 11/30/18 6:14 AM, Sumit Bose wrote:
>  On Thu, Nov 29, 2018 at 02:03:09PM -0700, Orion Poplawski wrote:
> > On 11/28/18 11:29 PM, Sumit Bose wrote:
> >> On Wed, Nov 28, 2018 at 04:57:17PM -0700, Orion Poplawski wrote:
> >>> I configured a YubiKey on Windows using the YubiKey minidriver with the
> >>> following certificates:
> >>>
> >>> - my "orion" certificate - went into slot 9a PIV Auth
> >>> - A MacOS keychain cert per their docs - when into slot 9d Key Management
> >>> - Another auth certificate for "orion-admin" - went into slot 82
> >>>
> >>> I'm able to authenticate on Windows as either orion or orion-admin, but
> on
> >>> Linux with sssd it does not see the orion-admin certificate.  What needs to
> >>> happen to support this?
> >>
> >> Which version of SSSD are you using?
> >
> > On F29:
> >
> > sssd-2.0.0-4.fc29.x86_64
> >
> > I get somewhat different behavior.  First the gdm login screen presents two
> > certificates:
> >
> >  - Certificate for Key Management
> >  - Certificate for PIV Authentication
> >
> > but still does not list the admin cert.  Also, I don't believe it should list
> > the Key Management cert because it is not flagged for smart card authentication.
>  
>  Do you mean the labels 'Certificate for PIV Authentication' and
>  'Certificate for Key Management' by 'flagged'?
>  
>  SSSD only looks at the content of the certificate and by default uses
>  everything with key usage digitalSignature and extended key usage
>  clientAuth. With F29 you can modify this by adding mapping and matching
>  rules to sssd.conf, see the 'CERTIFICATE MAPPING SECTION' in man
>  sssd.conf for details. 
The certificate in slot 9d Key Management is not flagged with key usage
Digital Signature or Client Auth:

# p11tool  --provider opensc-pkcs11.so --export
'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=d75c91b27c25efbd;token=Orion%20Poplawski;id=%03;object=Certificate%20for%20Key%20Management;type=cert'
| openssl x509 -in /dev/stdin -purpose -noout -text

            X509v3 Extended Key Usage:
                Microsoft Encrypted File System
            X509v3 Key Usage: critical
                Key Encipherment

so it should not be listed.  I don't have any certmap sections so I'm just
using the default.  Now - is gdm going through sssd to display the available
certificates, or is it doing it's own thing?

> >> Can you sent the output of 
> >>
> >>     p11tool  --list-all --provider opensc-pkcs11.so
>  
>  The slots for the retired keys are not visible. I've found
>  https://github.com/OpenSC/OpenSC/issues/847#issuecomment-238119888 with
>  a command which made the slots visible for PKCS#11 on my Yubikey.
>  Nevertheless the type is still data even after importing a certificate
>  with 'yubico-piv-tool -a import-certificate'. Maybe this is different
>  when using the Windows driver? 
I'm sorry, I can't determine what needs to be done to make the slot visible
from the link above.

>  Since you already reached out to Yubico you might want to ask as
> well
>  what needs to be done to make the certificates and private keys stored
>  in the retired slots properly available as certificate and private key
>  on the PKCS#11 level.
>   
The latest response from Yubico is:

If you enrolled certificates on a Windows system utilizing the YubiKey Smart
Card Minidriver, this would explain why your certificates are showing in those
slots. Microsoft doesn't follow the NIST standard when enrolling certificates
to a Smart card, they rely on a container map file that records the location
and EKU (OIDS) from a certificate to present to Windows what they are
available to be used for authentication. this is how you can have multiple
authentication certificates (9a) with the Minidriver vs without.


I have asked for clarification on thie "container map file".


-- 
Orion Poplawski
Manager of NWRA Technical Systems          720-772-5637
NWRA, Boulder/CoRA Office             FAX: [phone]
3380 Mitchell Lane                       orion(a)nwra.com
Boulder, CO 80301                 https://www.nwra.com/

[Orion Poplawski]

On 11/30/18 6:14 AM, Sumit Bose wrote:
>  On Thu, Nov 29, 2018 at 02:03:09PM -0700, Orion Poplawski wrote:
> > On 11/28/18 11:29 PM, Sumit Bose wrote:
> >> On Wed, Nov 28, 2018 at 04:57:17PM -0700, Orion Poplawski wrote:
> >>> I configured a YubiKey on Windows using the YubiKey minidriver with the
> >>> following certificates:
> >>>
> >>> - my "orion" certificate - went into slot 9a PIV Auth
> >>> - A MacOS keychain cert per their docs - when into slot 9d Key Management
> >>> - Another auth certificate for "orion-admin" - went into slot 82
> >>>
> >>> I'm able to authenticate on Windows as either orion or orion-admin, but
> on
> >>> Linux with sssd it does not see the orion-admin certificate.  What needs to
> >>> happen to support this?
> >>
> >> Which version of SSSD are you using?
> >
> > On F29:
> >
> > sssd-2.0.0-4.fc29.x86_64
> >
> > I get somewhat different behavior.  First the gdm login screen presents two
> > certificates:
> >
> >  - Certificate for Key Management
> >  - Certificate for PIV Authentication
> >
> > but still does not list the admin cert.  Also, I don't believe it should list
> > the Key Management cert because it is not flagged for smart card authentication.
>  
>  Do you mean the labels 'Certificate for PIV Authentication' and
>  'Certificate for Key Management' by 'flagged'?
>  
>  SSSD only looks at the content of the certificate and by default uses
>  everything with key usage digitalSignature and extended key usage
>  clientAuth. With F29 you can modify this by adding mapping and matching
>  rules to sssd.conf, see the 'CERTIFICATE MAPPING SECTION' in man
>  sssd.conf for details.
>  
> >
> >
> >> Can you sent the output of 
> >>
> >>     p11tool  --list-all --provider opensc-pkcs11.so
>  
>  The slots for the retired keys are not visible. I've found
>  https://github.com/OpenSC/OpenSC/issues/847#issuecomment-238119888 with
>  a command which made the slots visible for PKCS#11 on my Yubikey.
>  Nevertheless the type is still data even after importing a certificate
>  with 'yubico-piv-tool -a import-certificate'. Maybe this is different
>  when using the Windows driver? 
I finally figured out the this was suggesting writing the key history object
to the yubikey.  However, we are using the Yubikeys in a mode where we don't
have (or know) the management key - so I don't seem to be able to write the
object.

>  Since you already reached out to Yubico you might want to ask as
> well
>  what needs to be done to make the certificates and private keys stored
>  in the retired slots properly available as certificate and private key
>  on the PKCS#11 level. 
I was hoping we could somehow make use of the Yubico PKCS#11 provider module?
Using it appears to report all of the slots at least:


# p11tool  --list-all --provider libykcs11.so
Object 0:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20PIV%20Authentication%00
        Type: Unknown
        Label: X.509 Certificate for PIV Authentication
        ID:

Object 1:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Card%20Authentication%00
        Type: Unknown
        Label: X.509 Certificate for Card Authentication
        ID:

Object 2:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Digital%20Signature%00
        Type: Unknown
        Label: X.509 Certificate for Digital Signature
        ID:

Object 3:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Key%20Management%00
        Type: Unknown
        Label: X.509 Certificate for Key Management
        ID:

Object 4:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%201%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 1
        ID:

Object 5:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%202%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 2
        ID:

Object 6:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%203%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 3
        ID:

Object 7:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%204%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 4
        ID:

Object 8:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%205%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 5
        ID:

Object 9:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%206%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 6
        ID:

Object 10:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%207%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 7
        ID:

Object 11:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%208%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 8
        ID:

Object 12:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%209%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 9
        ID:

Object 13:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2010%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 10
        ID:

Object 14:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2011%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 11
        ID:

Object 15:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2012%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 12
        ID:

Object 16:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2013%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 13
        ID:

Object 17:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2014%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 14
        ID:

Object 18:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2015%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 15
        ID:

Object 19:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2016%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 16
        ID:

Object 20:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2017%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 17
        ID:

Object 21:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2018%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 18
        ID:

Object 22:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2019%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 19
        ID:

Object 23:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2020%00
        Type: Unknown
        Label: X.509 Certificate for Retired Key 20
        ID:

Object 24:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=Card%20Capability%20Container%00
        Type: Unknown
        Label: Card Capability Container
        ID:

Object 25:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=Card%20Holder%20Unique%20Identifier%00
        Type: Unknown
        Label: Card Holder Unique Identifier
        ID:

Object 26:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=Security%20Object%00
        Type: Unknown
        Label: Security Object
        ID:

Object 27:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%00;object=X.509%20Certificate%20for%20PIV%20Authentication%00;type=cert
        Type: X.509 Certificate
        Label: X.509 Certificate for PIV Authentication
        ID: 00

Object 28:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%03;object=X.509%20Certificate%20for%20Key%20Management%00;type=cert
        Type: X.509 Certificate
        Label: X.509 Certificate for Key Management
        ID: 03

Object 29:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%00;object=Public%20key%20for%20PIV%20Authentication%00;type=public
        Type: Public key (RSA-2048)
        Label: Public key for PIV Authentication
        ID: 00

Object 30:
        URL:
pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%03;object=Public%20key%20for%20Key%20Management%00;type=public
        Type: Public key (RSA-2048)
        Label: Public key for Key Management
        ID: 03

But sssd doesn't appear to like it:

# /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
(Fri Nov 30 14:38:04:069338 2018) [[sssd[p11_child[3904]]]] [main] (0x0400):
p11_child started.
(Fri Nov 30 14:38:04:069604 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
Running in [pre-auth] mode.
(Fri Nov 30 14:38:04:069853 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
Running with effective IDs: [0][0].
(Fri Nov 30 14:38:04:070075 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
Running with real IDs [0][0].
(Fri Nov 30 14:38:04:073047 2018) [[sssd[p11_child[3904]]]]
[init_verification] (0x0040): X509_LOOKUP_load_file failed
[185090184][error:0B084088:x509 certificate
routines:X509_load_cert_crl_file:no certificate or crl found].
(Fri Nov 30 14:38:04:073234 2018) [[sssd[p11_child[3904]]]] [do_work]
(0x0040): init_verification failed.
(Fri Nov 30 14:38:04:073469 2018) [[sssd[p11_child[3904]]]] [main] (0x0040):
do_work failed.
(Fri Nov 30 14:38:04:073682 2018) [[sssd[p11_child[3904]]]] [main] (0x0020):
p11_child failed!

And indeed it seems to be an incomplete implementation:

# p11tool --export
'pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20PIV%20Authentication%00'
--debug 100 --provider libykcs11.so
....
|<3>| ASSERT: pkcs11.c[pkcs11_import_object]:2120
debug: ykcs11.c:1259 (C_GetAttributeValue): In
debug: objects.c:398 (get_doa): For data object 0, get
debug: objects.c:436 (get_doa): VALUE TODO!!!
debug: ykcs11.c:1286 (C_GetAttributeValue): Unable to get attribute 0x11 of
object 0
debug: ykcs11.c:1291 (C_GetAttributeValue): Out
|<3>| ASSERT: pkcs11.c[pkcs11_import_object]:2134
debug: ykcs11.c:1460 (C_FindObjectsFinal): In
debug: ykcs11.c:1485 (C_FindObjectsFinal): Out
debug: ykcs11.c:663 (C_CloseSession): In
debug: ykcs11.c:688 (C_CloseSession): Out
|<3>| ASSERT: pkcs11.c[gnutls_pkcs11_obj_export3]:1376
Error in pkcs11_export:562: The requested data were not available.

I've filed https://github.com/Yubico/yubico-piv-tool/issues/175

-- 
Orion Poplawski
Manager of NWRA Technical Systems          720-772-5637
NWRA, Boulder/CoRA Office             FAX: [phone]
3380 Mitchell Lane                       orion(a)nwra.com
Boulder, CO 80301                 https://www.nwra.com/

[Sumit Bose]

On Fri, Nov 30, 2018 at 03:38:55PM -0700, Orion Poplawski wrote:
>  On 11/30/18 6:14 AM, Sumit Bose wrote:
>  > On Thu, Nov 29, 2018 at 02:03:09PM -0700, Orion Poplawski wrote:
>  >> On 11/28/18 11:29 PM, Sumit Bose wrote:
>  >>> On Wed, Nov 28, 2018 at 04:57:17PM -0700, Orion Poplawski wrote:
>  >>>> I configured a YubiKey on Windows using the YubiKey minidriver with the
>  >>>> following certificates:
>  >>>>
>  >>>> - my "orion" certificate - went into slot 9a PIV Auth
>  >>>> - A MacOS keychain cert per their docs - when into slot 9d Key
> Management
>  >>>> - Another auth certificate for "orion-admin" - went into slot
> 82
>  >>>>
>  >>>> I'm able to authenticate on Windows as either orion or orion-admin,
> but on
>  >>>> Linux with sssd it does not see the orion-admin certificate.  What needs
> to
>  >>>> happen to support this?
>  >>>
>  >>> Which version of SSSD are you using?
>  >>
>  >> On F29:
>  >>
>  >> sssd-2.0.0-4.fc29.x86_64
>  >>
>  >> I get somewhat different behavior.  First the gdm login screen presents two
>  >> certificates:
>  >>
>  >>  - Certificate for Key Management
>  >>  - Certificate for PIV Authentication
>  >>
>  >> but still does not list the admin cert.  Also, I don't believe it should
> list
>  >> the Key Management cert because it is not flagged for smart card
> authentication.
>  > 
>  > Do you mean the labels 'Certificate for PIV Authentication' and
>  > 'Certificate for Key Management' by 'flagged'?
>  > 
>  > SSSD only looks at the content of the certificate and by default uses
>  > everything with key usage digitalSignature and extended key usage
>  > clientAuth. With F29 you can modify this by adding mapping and matching
>  > rules to sssd.conf, see the 'CERTIFICATE MAPPING SECTION' in man
>  > sssd.conf for details.
>  > 
>  >>
>  >>
>  >>> Can you sent the output of 
>  >>>
>  >>>     p11tool  --list-all --provider opensc-pkcs11.so
>  > 
>  > The slots for the retired keys are not visible. I've found
>  > https://github.com/OpenSC/OpenSC/issues/847#issuecomment-238119888 with
>  > a command which made the slots visible for PKCS#11 on my Yubikey.
>  > Nevertheless the type is still data even after importing a certificate
>  > with 'yubico-piv-tool -a import-certificate'. Maybe this is different
>  > when using the Windows driver?
>  
>  I finally figured out the this was suggesting writing the key history object
>  to the yubikey.  However, we are using the Yubikeys in a mode where we don't
>  have (or know) the management key - so I don't seem to be able to write the
>  object.
>  
>  > Since you already reached out to Yubico you might want to ask as well
>  > what needs to be done to make the certificates and private keys stored
>  > in the retired slots properly available as certificate and private key
>  > on the PKCS#11 level.
>  
>  I was hoping we could somehow make use of the Yubico PKCS#11 provider module?
>  Using it appears to report all of the slots at least:
>  
>  
>  # p11tool  --list-all --provider libykcs11.so
>  Object 0:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20PIV%20Authentication%00
>          Type: Unknown
>          Label: X.509 Certificate for PIV Authentication
>          ID:
>  
>  Object 1:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Card%20Authentication%00
>          Type: Unknown
>          Label: X.509 Certificate for Card Authentication
>          ID:
>  
>  Object 2:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Digital%20Signature%00
>          Type: Unknown
>          Label: X.509 Certificate for Digital Signature
>          ID:
>  
>  Object 3:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Key%20Management%00
>          Type: Unknown
>          Label: X.509 Certificate for Key Management
>          ID:
>  
>  Object 4:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%201%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 1
>          ID:
>  
>  Object 5:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%202%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 2
>          ID:
>  
>  Object 6:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%203%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 3
>          ID:
>  
>  Object 7:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%204%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 4
>          ID:
>  
>  Object 8:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%205%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 5
>          ID:
>  
>  Object 9:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%206%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 6
>          ID:
>  
>  Object 10:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%207%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 7
>          ID:
>  
>  Object 11:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%208%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 8
>          ID:
>  
>  Object 12:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%209%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 9
>          ID:
>  
>  Object 13:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2010%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 10
>          ID:
>  
>  Object 14:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2011%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 11
>          ID:
>  
>  Object 15:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2012%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 12
>          ID:
>  
>  Object 16:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2013%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 13
>          ID:
>  
>  Object 17:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2014%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 14
>          ID:
>  
>  Object 18:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2015%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 15
>          ID:
>  
>  Object 19:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2016%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 16
>          ID:
>  
>  Object 20:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2017%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 17
>          ID:
>  
>  Object 21:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2018%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 18
>          ID:
>  
>  Object 22:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2019%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 19
>          ID:
>  
>  Object 23:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20Retired%20Key%2020%00
>          Type: Unknown
>          Label: X.509 Certificate for Retired Key 20
>          ID:
>  
>  Object 24:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=Card%20Capability%20Container%00
>          Type: Unknown
>          Label: Card Capability Container
>          ID:
>  
>  Object 25:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=Card%20Holder%20Unique%20Identifier%00
>          Type: Unknown
>          Label: Card Holder Unique Identifier
>          ID:
>  
>  Object 26:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=Security%20Object%00
>          Type: Unknown
>          Label: Security Object
>          ID:
>  
>  Object 27:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%00;object=X.509%20Certificate%20for%20PIV%20Authentication%00;type=cert
>          Type: X.509 Certificate
>          Label: X.509 Certificate for PIV Authentication
>          ID: 00
>  
>  Object 28:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%03;object=X.509%20Certificate%20for%20Key%20Management%00;type=cert
>          Type: X.509 Certificate
>          Label: X.509 Certificate for Key Management
>          ID: 03
>  
>  Object 29:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%00;object=Public%20key%20for%20PIV%20Authentication%00;type=public
>          Type: Public key (RSA-2048)
>          Label: Public key for PIV Authentication
>          ID: 00
>  
>  Object 30:
>          URL:
>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%03;object=Public%20key%20for%20Key%20Management%00;type=public
>          Type: Public key (RSA-2048)
>          Label: Public key for Key Management
>          ID: 03
>  
>  But sssd doesn't appear to like it:
>  
>  # /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
>  (Fri Nov 30 14:38:04:069338 2018) [[sssd[p11_child[3904]]]] [main] (0x0400):
>  p11_child started.
>  (Fri Nov 30 14:38:04:069604 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
>  Running in [pre-auth] mode.
>  (Fri Nov 30 14:38:04:069853 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
>  Running with effective IDs: [0][0].
>  (Fri Nov 30 14:38:04:070075 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
>  Running with real IDs [0][0].
>  (Fri Nov 30 14:38:04:073047 2018) [[sssd[p11_child[3904]]]]
>  [init_verification] (0x0040): X509_LOOKUP_load_file failed
>  [185090184][error:0B084088:x509 certificate
>  routines:X509_load_cert_crl_file:no certificate or crl found]. 
I guess you tried this on F29 where the OpenSSL build is used. Here you
have to use '--nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem' or to a
different file which contains your CA certificates.


Additionally it looks like libykcs11.so does not come with a p11-kit
config file, so you have to add something like

cat > /usr/share/p11-kit/modules/ykcs11.module << END_END
module: /usr/lib64/libykcs11.so.1
END_END

One RHEL/CentOS 7 you have to add it to /etc/pki/nssdb.

HTH

bye,
Sumit

> (Fri Nov 30 14:38:04:073234 2018) [[sssd[p11_child[3904]]]] [do_work]
> (0x0040): init_verification failed.
> (Fri Nov 30 14:38:04:073469 2018) [[sssd[p11_child[3904]]]] [main] (0x0040):
> do_work failed.
> (Fri Nov 30 14:38:04:073682 2018) [[sssd[p11_child[3904]]]] [main] (0x0020):
> p11_child failed!
> 
> And indeed it seems to be an incomplete implementation:
> 
> # p11tool --export
>
'pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20PIV%20Authentication%00'
> --debug 100 --provider libykcs11.so
> ....
> |<3>| ASSERT: pkcs11.c[pkcs11_import_object]:2120
> debug: ykcs11.c:1259 (C_GetAttributeValue): In
> debug: objects.c:398 (get_doa): For data object 0, get
> debug: objects.c:436 (get_doa): VALUE TODO!!!
> debug: ykcs11.c:1286 (C_GetAttributeValue): Unable to get attribute 0x11 of
> object 0
> debug: ykcs11.c:1291 (C_GetAttributeValue): Out
> |<3>| ASSERT: pkcs11.c[pkcs11_import_object]:2134
> debug: ykcs11.c:1460 (C_FindObjectsFinal): In
> debug: ykcs11.c:1485 (C_FindObjectsFinal): Out
> debug: ykcs11.c:663 (C_CloseSession): In
> debug: ykcs11.c:688 (C_CloseSession): Out
> |<3>| ASSERT: pkcs11.c[gnutls_pkcs11_obj_export3]:1376
> Error in pkcs11_export:562: The requested data were not available.
> 
> I've filed https://github.com/Yubico/yubico-piv-tool/issues/175
> 
> -- 
> Orion Poplawski
> Manager of NWRA Technical Systems          720-772-5637
> NWRA, Boulder/CoRA Office             FAX: [phone]
> 3380 Mitchell Lane                       orion(a)nwra.com
> Boulder, CO 80301                 https://www.nwra.com/

[Orion Poplawski]

On 12/1/18 3:29 AM, Sumit Bose wrote:
>  On Fri, Nov 30, 2018 at 03:38:55PM -0700, Orion Poplawski wrote:
> > On 11/30/18 6:14 AM, Sumit Bose wrote:
> >> On Thu, Nov 29, 2018 at 02:03:09PM -0700, Orion Poplawski wrote:
> >>> On 11/28/18 11:29 PM, Sumit Bose wrote:
> >>>> On Wed, Nov 28, 2018 at 04:57:17PM -0700, Orion Poplawski wrote:
> >>>>> I configured a YubiKey on Windows using the YubiKey minidriver with
> the
> >>>>> following certificates:
> >>>>>
> >>>>> - my "orion" certificate - went into slot 9a PIV Auth
> >>>>> - A MacOS keychain cert per their docs - when into slot 9d Key
> Management
> >>>>> - Another auth certificate for "orion-admin" - went into
> slot 82
> >>>>>
> >>>>> I'm able to authenticate on Windows as either orion or
> orion-admin, but on
> >>>>> Linux with sssd it does not see the orion-admin certificate.  What
> needs to
> >>>>> happen to support this?
> >>>>
> >>>> Which version of SSSD are you using?
> >>>
> >>> On F29:
> >>>
> >>> sssd-2.0.0-4.fc29.x86_64
> >>>
> >>> I get somewhat different behavior.  First the gdm login screen presents two
> >>> certificates:
> >>>
> >>>  - Certificate for Key Management
> >>>  - Certificate for PIV Authentication
> >>>
> >>> but still does not list the admin cert.  Also, I don't believe it should
> list
> >>> the Key Management cert because it is not flagged for smart card
> authentication.
> >>
> >> Do you mean the labels 'Certificate for PIV Authentication' and
> >> 'Certificate for Key Management' by 'flagged'?
> >>
> >> SSSD only looks at the content of the certificate and by default uses
> >> everything with key usage digitalSignature and extended key usage
> >> clientAuth. With F29 you can modify this by adding mapping and matching
> >> rules to sssd.conf, see the 'CERTIFICATE MAPPING SECTION' in man
> >> sssd.conf for details.
> >>
> >>>
> >>>
> >>>> Can you sent the output of 
> >>>>
> >>>>     p11tool  --list-all --provider opensc-pkcs11.so
> >>
> >> The slots for the retired keys are not visible. I've found
> >> https://github.com/OpenSC/OpenSC/issues/847#issuecomment-238119888 with
> >> a command which made the slots visible for PKCS#11 on my Yubikey.
> >> Nevertheless the type is still data even after importing a certificate
> >> with 'yubico-piv-tool -a import-certificate'. Maybe this is different
> >> when using the Windows driver?
> >
> > I finally figured out the this was suggesting writing the key history object
> > to the yubikey.  However, we are using the Yubikeys in a mode where we don't
> > have (or know) the management key - so I don't seem to be able to write the
> > object.
> >
> >> Since you already reached out to Yubico you might want to ask as well
> >> what needs to be done to make the certificates and private keys stored
> >> in the retired slots properly available as certificate and private key
> >> on the PKCS#11 level.
> >
> > I was hoping we could somehow make use of the Yubico PKCS#11 provider module?
> > Using it appears to report all of the slots at least:
> >
> >
> > # p11tool  --list-all --provider libykcs11.so
> > Object 0:
> >         URL:
> >
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20PIV%20Authentication%00
> >         Type: Unknown
> >         Label: X.509 Certificate for PIV Authentication
> >         ID: 
...
> > Object 30:
> >         URL:
> >
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%03;object=Public%20key%20for%20Key%20Management%00;type=public
> >         Type: Public key (RSA-2048)
> >         Label: Public key for Key Management
> >         ID: 03
> >
> > But sssd doesn't appear to like it:
> >
> > # /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
> > (Fri Nov 30 14:38:04:069338 2018) [[sssd[p11_child[3904]]]] [main] (0x0400):
> > p11_child started.
> > (Fri Nov 30 14:38:04:069604 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
> > Running in [pre-auth] mode.
> > (Fri Nov 30 14:38:04:069853 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
> > Running with effective IDs: [0][0].
> > (Fri Nov 30 14:38:04:070075 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
> > Running with real IDs [0][0].
> > (Fri Nov 30 14:38:04:073047 2018) [[sssd[p11_child[3904]]]]
> > [init_verification] (0x0040): X509_LOOKUP_load_file failed
> > [185090184][error:0B084088:x509 certificate
> > routines:X509_load_cert_crl_file:no certificate or crl found].
>  
>  I guess you tried this on F29 where the OpenSSL build is used. Here you
>  have to use '--nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem' or to a
>  different file which contains your CA certificates.
>  
>  
>  Additionally it looks like libykcs11.so does not come with a p11-kit
>  config file, so you have to add something like
>  
>  cat > /usr/share/p11-kit/modules/ykcs11.module << END_END
>  module: /usr/lib64/libykcs11.so.1
>  END_END
>  
>  One RHEL/CentOS 7 you have to add it to /etc/pki/nssdb. 
yeah, I started work on p11-kit integration and filed
https://github.com/Yubico/yubico-piv-tool/pull/176 to do that.  But the real
issue is that libykcs11.so is not a (fully) working PKCS#11 implementation.
It appears to support being a ssh-agent plugin but that's about it.  See below
again for more info.  So I'm back to trying to figure out how to get the Key
History object added to our keys.

Thanks again.

>  
> > (Fri Nov 30 14:38:04:073234 2018) [[sssd[p11_child[3904]]]] [do_work]
> > (0x0040): init_verification failed.
> > (Fri Nov 30 14:38:04:073469 2018) [[sssd[p11_child[3904]]]] [main] (0x0040):
> > do_work failed.
> > (Fri Nov 30 14:38:04:073682 2018) [[sssd[p11_child[3904]]]] [main] (0x0020):
> > p11_child failed!
> >
> > And indeed it seems to be an incomplete implementation:
> >
> > # p11tool --export
> >
> 'pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20PIV%20Authentication%00'
> > --debug 100 --provider libykcs11.so
> > ....
> > |<3>| ASSERT: pkcs11.c[pkcs11_import_object]:2120
> > debug: ykcs11.c:1259 (C_GetAttributeValue): In
> > debug: objects.c:398 (get_doa): For data object 0, get
> > debug: objects.c:436 (get_doa): VALUE TODO!!!
> > debug: ykcs11.c:1286 (C_GetAttributeValue): Unable to get attribute 0x11 of
> > object 0
> > debug: ykcs11.c:1291 (C_GetAttributeValue): Out
> > |<3>| ASSERT: pkcs11.c[pkcs11_import_object]:2134
> > debug: ykcs11.c:1460 (C_FindObjectsFinal): In
> > debug: ykcs11.c:1485 (C_FindObjectsFinal): Out
> > debug: ykcs11.c:663 (C_CloseSession): In
> > debug: ykcs11.c:688 (C_CloseSession): Out
> > |<3>| ASSERT: pkcs11.c[gnutls_pkcs11_obj_export3]:1376
> > Error in pkcs11_export:562: The requested data were not available.
> >
> > I've filed https://github.com/Yubico/yubico-piv-tool/issues/175 

-- 
Orion Poplawski
Manager of NWRA Technical Systems          720-772-5637
NWRA, Boulder/CoRA Office             FAX: [phone]
3380 Mitchell Lane                       orion(a)nwra.com
Boulder, CO 80301                 https://www.nwra.com/

[Sumit Bose]

On Mon, Dec 03, 2018 at 11:54:44AM -0700, Orion Poplawski wrote:
>  On 12/1/18 3:29 AM, Sumit Bose wrote:
>  > On Fri, Nov 30, 2018 at 03:38:55PM -0700, Orion Poplawski wrote:
>  >> On 11/30/18 6:14 AM, Sumit Bose wrote:
>  >>> On Thu, Nov 29, 2018 at 02:03:09PM -0700, Orion Poplawski wrote:
>  >>>> On 11/28/18 11:29 PM, Sumit Bose wrote:
>  >>>>> On Wed, Nov 28, 2018 at 04:57:17PM -0700, Orion Poplawski wrote:
>  >>>>>> I configured a YubiKey on Windows using the YubiKey minidriver
> with the
>  >>>>>> following certificates:
>  >>>>>>
>  >>>>>> - my "orion" certificate - went into slot 9a PIV Auth
>  >>>>>> - A MacOS keychain cert per their docs - when into slot 9d Key
> Management
>  >>>>>> - Another auth certificate for "orion-admin" - went
> into slot 82
>  >>>>>>
>  >>>>>> I'm able to authenticate on Windows as either orion or
> orion-admin, but on
>  >>>>>> Linux with sssd it does not see the orion-admin certificate. 
> What needs to
>  >>>>>> happen to support this?
>  >>>>>
>  >>>>> Which version of SSSD are you using?
>  >>>>
>  >>>> On F29:
>  >>>>
>  >>>> sssd-2.0.0-4.fc29.x86_64
>  >>>>
>  >>>> I get somewhat different behavior.  First the gdm login screen presents
> two
>  >>>> certificates:
>  >>>>
>  >>>>  - Certificate for Key Management
>  >>>>  - Certificate for PIV Authentication
>  >>>>
>  >>>> but still does not list the admin cert.  Also, I don't believe it
> should list
>  >>>> the Key Management cert because it is not flagged for smart card
> authentication.
>  >>>
>  >>> Do you mean the labels 'Certificate for PIV Authentication' and
>  >>> 'Certificate for Key Management' by 'flagged'?
>  >>>
>  >>> SSSD only looks at the content of the certificate and by default uses
>  >>> everything with key usage digitalSignature and extended key usage
>  >>> clientAuth. With F29 you can modify this by adding mapping and matching
>  >>> rules to sssd.conf, see the 'CERTIFICATE MAPPING SECTION' in man
>  >>> sssd.conf for details.
>  >>>
>  >>>>
>  >>>>
>  >>>>> Can you sent the output of 
>  >>>>>
>  >>>>>     p11tool  --list-all --provider opensc-pkcs11.so
>  >>>
>  >>> The slots for the retired keys are not visible. I've found
>  >>> https://github.com/OpenSC/OpenSC/issues/847#issuecomment-238119888 with
>  >>> a command which made the slots visible for PKCS#11 on my Yubikey.
>  >>> Nevertheless the type is still data even after importing a certificate
>  >>> with 'yubico-piv-tool -a import-certificate'. Maybe this is
> different
>  >>> when using the Windows driver?
>  >>
>  >> I finally figured out the this was suggesting writing the key history object
>  >> to the yubikey.  However, we are using the Yubikeys in a mode where we
> don't
>  >> have (or know) the management key - so I don't seem to be able to write the
>  >> object.
>  >>
>  >>> Since you already reached out to Yubico you might want to ask as well
>  >>> what needs to be done to make the certificates and private keys stored
>  >>> in the retired slots properly available as certificate and private key
>  >>> on the PKCS#11 level.
>  >>
>  >> I was hoping we could somehow make use of the Yubico PKCS#11 provider module?
>  >> Using it appears to report all of the slots at least:
>  >>
>  >>
>  >> # p11tool  --list-all --provider libykcs11.so
>  >> Object 0:
>  >>         URL:
>  >>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20PIV%20Authentication%00
>  >>         Type: Unknown
>  >>         Label: X.509 Certificate for PIV Authentication
>  >>         ID:
>  ...
>  >> Object 30:
>  >>         URL:
>  >>
> pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;id=%03;object=Public%20key%20for%20Key%20Management%00;type=public
>  >>         Type: Public key (RSA-2048)
>  >>         Label: Public key for Key Management
>  >>         ID: 03
>  >>
>  >> But sssd doesn't appear to like it:
>  >>
>  >> # /usr/libexec/sssd/p11_child -d 10 --debug-fd=1 --nssdb=/etc/pki/nssdb --pre
>  >> (Fri Nov 30 14:38:04:069338 2018) [[sssd[p11_child[3904]]]] [main] (0x0400):
>  >> p11_child started.
>  >> (Fri Nov 30 14:38:04:069604 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
>  >> Running in [pre-auth] mode.
>  >> (Fri Nov 30 14:38:04:069853 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
>  >> Running with effective IDs: [0][0].
>  >> (Fri Nov 30 14:38:04:070075 2018) [[sssd[p11_child[3904]]]] [main] (0x2000):
>  >> Running with real IDs [0][0].
>  >> (Fri Nov 30 14:38:04:073047 2018) [[sssd[p11_child[3904]]]]
>  >> [init_verification] (0x0040): X509_LOOKUP_load_file failed
>  >> [185090184][error:0B084088:x509 certificate
>  >> routines:X509_load_cert_crl_file:no certificate or crl found].
>  > 
>  > I guess you tried this on F29 where the OpenSSL build is used. Here you
>  > have to use '--nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem' or to a
>  > different file which contains your CA certificates.
>  > 
>  > 
>  > Additionally it looks like libykcs11.so does not come with a p11-kit
>  > config file, so you have to add something like
>  > 
>  > cat > /usr/share/p11-kit/modules/ykcs11.module << END_END
>  > module: /usr/lib64/libykcs11.so.1
>  > END_END
>  > 
>  > One RHEL/CentOS 7 you have to add it to /etc/pki/nssdb.
>  
>  yeah, I started work on p11-kit integration and filed
>  https://github.com/Yubico/yubico-piv-tool/pull/176 to do that.  But the real
>  issue is that libykcs11.so is not a (fully) working PKCS#11 implementation.
>  It appears to support being a ssh-agent plugin but that's about it.  See below
>  again for more info.  So I'm back to trying to figure out how to get the Key
>  History object added to our keys.
>  
>  Thanks again.
>  
>  > 
>  >> (Fri Nov 30 14:38:04:073234 2018) [[sssd[p11_child[3904]]]] [do_work]
>  >> (0x0040): init_verification failed.
>  >> (Fri Nov 30 14:38:04:073469 2018) [[sssd[p11_child[3904]]]] [main] (0x0040):
>  >> do_work failed.
>  >> (Fri Nov 30 14:38:04:073682 2018) [[sssd[p11_child[3904]]]] [main] (0x0020):
>  >> p11_child failed!
>  >>
>  >> And indeed it seems to be an incomplete implementation:
>  >>
>  >> # p11tool --export
>  >>
> 'pkcs11:model=YubiKey%20YK4;manufacturer=Yubico;serial=1234;token=YubiKey%20PIV;object=X.509%20Certificate%20for%20PIV%20Authentication%00'
>  >> --debug 100 --provider libykcs11.so
>  >> ....
>  >> |<3>| ASSERT: pkcs11.c[pkcs11_import_object]:2120
>  >> debug: ykcs11.c:1259 (C_GetAttributeValue): In
>  >> debug: objects.c:398 (get_doa): For data object 0, get
>  >> debug: objects.c:436 (get_doa): VALUE TODO!!!
>  >> debug: ykcs11.c:1286 (C_GetAttributeValue): Unable to get attribute 0x11 of
>  >> object 0
>  >> debug: ykcs11.c:1291 (C_GetAttributeValue): Out
>  >> |<3>| ASSERT: pkcs11.c[pkcs11_import_object]:2134
>  >> debug: ykcs11.c:1460 (C_FindObjectsFinal): In
>  >> debug: ykcs11.c:1485 (C_FindObjectsFinal): Out
>  >> debug: ykcs11.c:663 (C_CloseSession): In
>  >> debug: ykcs11.c:688 (C_CloseSession): Out
>  >> |<3>| ASSERT: pkcs11.c[gnutls_pkcs11_obj_export3]:1376
>  >> Error in pkcs11_export:562: The requested data were not available.
>  >>
>  >> I've filed https://github.com/Yubico/yubico-piv-tool/issues/175 
Which object to do want to export #0 or #27? Both objects match the
PKCS#11 URI you used:

    debug: ykcs11.c:1385 (C_FindObjectsInit): Removing object 91 from the list
    debug: ykcs11.c:1395 (C_FindObjectsInit): 2 object(s) left after attribute matching

and object #0 is picked:

    debug: ykcs11.c:1399 (C_FindObjectsInit): Out
    debug: ykcs11.c:1410 (C_FindObjects): In
    debug: ykcs11.c:1435 (C_FindObjects): Can return 1 object(s)
    debug: ykcs11.c:1451 (C_FindObjects): Returning object 0

However I guess that the object you were looking for is #27. To select
this you should add the id or the type to the URI.

In general I think it would be best if Yubico can work with OpenSC
upstream to allow OpenSC to access the full potential of the Yubikeys in
an easy way.

bye,
Sumit

> 
> 
> -- 
> Orion Poplawski
> Manager of NWRA Technical Systems          720-772-5637
> NWRA, Boulder/CoRA Office             FAX: [phone]
> 3380 Mitchell Lane                       orion(a)nwra.com
> Boulder, CO 80301                 https://www.nwra.com/

[Orion Poplawski]

On 11/28/18 4:57 PM, Orion Poplawski wrote:
>  I configured a YubiKey on Windows using the YubiKey minidriver with
> the
>  following certificates:
>  
>  - my "orion" certificate - went into slot 9a PIV Auth
>  - A MacOS keychain cert per their docs - when into slot 9d Key Management
>  - Another auth certificate for "orion-admin" - went into slot 82
>  
>  I'm able to authenticate on Windows as either orion or orion-admin, but on
>  Linux with sssd it does not see the orion-admin certificate.  What needs to
>  happen to support this?
>  
>  Thanks!
>   
After reading some of:

 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-73-4.pdf

I'm very curious as to why the admin key and certificate went into slot 82.
From my understanding slots 82-95 are for "Retired Key Management" - i.e. keys
that have been retired/expired/replaced.  Unless this specification has been
abandoned in some way?

I've asked the above question of Yubico - perhaps they will have an answer.
In any case this is definitely a non-standard application.

-- 
Orion Poplawski
Manager of NWRA Technical Systems          720-772-5637
NWRA, Boulder/CoRA Office             FAX: [phone]
3380 Mitchell Lane                       orion(a)nwra.com
Boulder, CO 80301                 https://www.nwra.com/