pkcs11: If user consent is ignored through configuration, do not pres… #2040
Conversation
Jakuje
force-pushed
the
ignore_user_consent
branch
from
5fef677
to
fd5cbb0
Compare
|
I tested this with yk, but I would like to see this tested also with PIV test cards, which should enforce reauthentication and therefore the cached pin should get used. But I do not have these at hand now. |
|
After reading through #2039 (comment) I believe this should happen only in combination with |
There was a problem hiding this comment.
After reading through #2039 (comment) I believe this should happen only in combination with
use_pin_caching = yes. I always forget about this option. What do you think?
I think we should clearify the description in the manual pages and in opensc.conf.example. Currently the text only mentions older applications, that don't support CKA_ALWAYS_AUTHENTICATE. We should also mention that switching on PIN caching is recommended when enabling pin_cache_ignore_user_consent.
Jakuje
force-pushed
the
ignore_user_consent
branch
from
fd5cbb0
to
834d9e8
Compare
|
Thanks for suggestion. I added this note both to manual pages and example configuration file. |
If user consent is ignored through configuration, do not present ALWAYS_AUTHENTICATE=TRUE attribute in PKCS#11 Fixes OpenSC#2039
…consent configuration option
Jakuje
force-pushed
the
ignore_user_consent
branch
from
834d9e8
to
25f7804
Compare
|
thank you |
…ent ALWAYS_AUTHENTICATE attribute
Fixes #2039
This extends the function of
pin_cache_ignore_user_consentto prevent presentingCKA_ALWAYS_AUTHENTICATEto applications, which understand this attribute and issue useless second PIN prompt (even though pin is already cached in OpenSC or not needed at all).I believe current documentation is fine (man opensc.conf), but if you believe it needs to be updated, please suggest.
Checklist