<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Okay. I haven't been able to get around this issue. I can log using my username, my card is recognized by GDM and reads the card as expected, but I am unable to login using my smartcard. From what I can see in the logs the common name on my card doesn't match the username on my test account. Feb 2 13:00:05 cabildo gdm-smartcard]: pam_krb5[5152]: error resolving user name '<SC-CommonName>' to uid/gid pair Feb 2 13:00:05 cabildo gdm-smartcard]: pam_krb5[5152]: error getting information about '<SC-CommonName> Feb 2 13:00:06 cabildo gdm-smartcard]: pam_unix(gdm-smartcard:account): could not identify user (from getpwnam(<SC-CommonName>)) Feb 2 13:00:06 cabildo gdm-smartcard]: pam_sss(gdm-smartcard:account): Access denied for user <SC-CommonName>: 10 (User not known to the underlying authentication module) Feb 2 13:00:06 cabildo gdm-smartcard]: pam_krb5[5152]: error resolving user name '<SC-CommonName>' to uid/gid pair Feb 2 13:00:13 cabildo gdm-smartcard]: pam_pkcs11(gdm-smartcard:auth): pam_get_pwd() failed: Conversation error Where do I go from here? <div class="moz-signature">Michael Rainey NRL 7320 Computer Support Group Building 1009, Room C156 Stennis Space Center, MS 39529 </div> <div class="moz-cite-prefix">On 02/02/2016 09:56 AM, Martin Kosek wrote: </div> <blockquote cite="mid:56B0D1A6.4070400@redhat.com" type="cite"> <pre wrap="">On 02/02/2016 04:49 PM, Michael Rainey (Contractor) wrote: </pre> <blockquote type="cite"> <pre wrap="">Greetings FreeIPA Community, I have been testing and working with the smart card login feature of the IPA server, and have had some successes with this project. However, my latest server/client setup isn't working as expected. I can where the problem is occurring, which is the Common Name on the Card is not being mapped to the proper attribute on the IPA server. So here's my question: Is there a howto which explains how an where this mapping occurs? Is this something I can configure myself, or is hard coded. </pre> </blockquote> <pre wrap=""> At the moment, the Smart Card support present in SSSD looks up the user by searching with a blob containing the whole SC certificate. This BTW means that the certificate needs to be present at user entry in FreeIPA to make sure it matches, no other mapping mechanism is available yet. We have some plans though: <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/V4/User_Certificates#Certificate_Identity_Mapping">http://www.freeipa.org/page/V4/User_Certificates#Certificate_Identity_Mapping</a> If you are interested in HOWTOs, Nathan Kinder put together pretty neat blog posts how to make Smart Card authentication working: <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/V4/User_Certificates#References">http://www.freeipa.org/page/V4/User_Certificates#References</a> HTH, Martin </pre> </blockquote> </body> </html>