Bug 1226218 - Unable to login with GDM when Yubikey is plugged in
Summary: Unable to login with GDM when Yubikey is plugged in
Status: NEW
Alias: None
Product: openSUSE Distribution
Classification: openSUSE
Component: GNOME (show other bugs)
Version: Leap 15.6
Hardware: x86-64 Other
: P5 - None : Major (vote)
Target Milestone: ---
Assignee: E-mail List
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-12 12:46 UTC by Robin Roevens
Modified: 2024-06-12 12:46 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robin Roevens 2024-06-12 12:46:26 UTC
Since upgrade from Leap 15.5 to 15.6 I'm no longer able to login with GDM when my Yubikey is inserted.
The system is configured to log in using pam_u2f.so requiring me to touch the Yubikey device to log in.

However since newest version, I get a username-field and a non functional 'back' button. Whenever I enter a username, it just refreshes and requests the username again. No password is asked, neither is asked to touch the Yubikey.

In the logging I find: 
---
gdm-smartcard][2964]: PAM unable to dlopen(/lib64/security/pam_pkcs11.so): /lib64/security/pam_pkcs11.so: kan gedeeld objectbestand niet openen: Bestand of map bestaat niet
gdm-smartcard][2964]: PAM adding faulty module: /lib64/security/pam_pkcs11.so
---

So I installed pam_pkcs11
Now when I enter the username in GDM it tells me to start smartcard authentication, and the light on the Yubikey lights up. When I touch it, it flickers once and then stays on again. Never proceeding login.
In the logging I now find:
---
gdm-smartcard][31888]: argument card_only is not supported by this module
gdm-smartcard][31888]: Failed to initialize crypto
gdm-smartcard][31888]: pam_pkcs11(gdm-smartcard:auth): Failed to initialize crypto
---

I also found this upstream bug: https://gitlab.gnome.org/GNOME/gdm/-/issues/877

It seems the yubikey is now detected as a smartcard despite it not been configured as a smartcard.
I also don't find understandable documentation describing how to configure Pam / GDM to accept the certificate on the Yubikey for a specific user.
Currently I can no longer log in using my Yubikey