Hi Chris,

To confirm, the fix is working fine for me when using a YubiKey with a smartcard certificate loaded onto it.


  *   Neil
From: <email address hidden> <email address hidden> on behalf of Chris Halse Rogers <email address hidden>
Date: Wednesday, 29 March 2023 at 01:55
To: Neil Webster <email address hidden>
Subject: [Bug 1999884] Re: gdm-smartcard not passing successful authentication to desktop at system logon
Can anyone do the testing for the kinetic update? Releasing to jammy-
updates is blocked on verifying the kinetic fix.

--
You received this bug notification because you are subscribed to the bug
report.
https://bugs.launchpad.net/bugs/1999884

Title:
  gdm-smartcard not passing successful authentication to desktop at
  system logon

Status in gdm3 package in Ubuntu:
  Fix Released
Status in sssd package in Ubuntu:
  Incomplete
Status in gdm3 source package in Jammy:
  Fix Committed
Status in gdm3 source package in Kinetic:
  Fix Committed

Bug description:
  [ Impact ]

  gdm-smartcard returns a Permission denied when logging in with an user
  name:

  + pamtester -v gdm-smartcard ubuntu authenticate
  pamtester: invoking pam_start(gdm-smartcard, ubuntu, ...)
  pamtester: performing operation - authenticate
  PIN for Test Organization Root Tr Token:
  pamtester: Permission denied

  Using an empty user name works instead.

  [ Test case ]

  1. Use a smartcard to login in gdm

  This can also be simulated via:

  # Must be ran as user
  sudo apt install pamtester
  pamtester -v gdm-smartcard $USER authenticate

  Expected output is
  + pamtester -v gdm-smartcard ubuntu authenticate
  pamtester: invoking pam_start(gdm-smartcard, ubuntu, ...)
  pamtester: performing operation - authenticate
  PIN for Test Organization Sub Int Token:
  pamtester: successfully authenticated

  ---

  Alternatively, if no smartcard or hardware is available, this can be tested and simulated using these scripts (they will reset the system setup at each run, but it's suggested to run them in a VM, lxd container or in a test installation):
   https://gist.github.com/3v1n0/287d02ca8e03936f1c7bba992173d47a

  - sudo apt install gdm3 pamtester softhsm2 openssl wget sssd gnutls-bin && \
    sudo apt-mark auto gdm3 pamtester softhsm2 openssl wget sssd gnutls-bin
  - wget https://gist.github.com/3v1n0/287d02ca8e03936f1c7bba992173d47a/raw/sssd-gdm-smartcard-pam-auth-tester.sh
  - sudo sssd-gdm-smartcard-pam-auth-tester.sh

  The script will generate some fake CA authority, issue some
  certificates, will install them in some software-based smartcards
  (using softhsm2) and test that they work properly to login with gdm-
  smartcard.

  Using `WAIT` environment variable set (to any value) will make it to
  restart gdm at each iteration so that an user can try to access, using
  the username that launched the script and the pin of 123456.

  [ Regression Potential ]

  A root user could access to pam_sss, however it's the responsibility
  of such module to block such access.

  ---

  For information I've repeated this entire process on RHEL8 and it
  works there, it also was working upon last test on Ubuntu 20.04

  Releases: 22.04 LTS and 22.10
  Package Version (for reporting purposes): 43.0-1ubuntu1

  Background:

  System has been configured with sssd, krb5 and pkinit.  All of these
  packages confirm a successful connection to the Active Directory
  Domain Controller.  I have a YubiKey which has a CA generated
  certificate on it (with all required uses/capabilities including sign)
  and this is working fine on other systems.

  Expected Behavior:

  Insert YubiKey before boot.  At the logon window press enter on the
  Username field.  Select the certificate, enter PIN when prompted.
  Authenticate to desktop.

  What is happening:

  Insert YubiKey before boot.  At the logon window press enter on the
  Username field.  Select the certificate, enter PIN when prompted.
  Returns to Username field and does not log in.

  Other:

  This is a clean install of 22.10 updated to 16 Dec 2022.  I also tried
  the same thing with 22.04 LTS just in case.

  I have enabled level 6 logging on SSSD and can confirm that side of
  the entire process is fine.  I can also log on with a password and do
  a kinit <username> and get a valid kerberos ticket.

  With some systematic tests, I managed to pinpoint the login is failing
  after gdm-smartcard reports a successful login:

  Dec 16 10:25:43 ubu-vm-2022 gdm-smartcard]: gkr-pam: stashed password to try later in open session
  Dec 16 10:26:22 ubu-vm-2022 gdm-smartcard]: pam_sss(gdm-smartcard:auth): authentication success; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost= <email address hidden>

  I did not have this problem on 20.04.

  ProblemType: BugDistroRelease: Ubuntu 22.10
  Package: gdm3 43.0-1ubuntu1
  ProcVersionSignature: Ubuntu 5.19.0-26.27-generic 5.19.7
  Uname: Linux 5.19.0-26-generic x86_64
  ApportVersion: 2.23.1-0ubuntu3
  Architecture: amd64
  CasperMD5CheckResult: pass
  CurrentDesktop: ubuntu:GNOME
  Date: Fri Dec 16 11:43:25 2022
  InstallationDate: Installed on 2022-12-16 (0 days ago)
  InstallationMedia: Ubuntu 22.10 "Kinetic Kudu" - Release amd64 (20221020)SourcePackage: gdm3
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gdm3/+bug/1999884/+subscriptions