From 018ee09ccbe7fc0a5b0909592eadd168224b2409 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Fri, 23 Jul 2021 18:17:19 -0400 Subject: [PATCH] ipa-advise: if p11-kit provides opensc, don't add to NSS db p11-kit-proxy in newer distributions handles loading the OpenSC PKCS#11 library so don't try to add it to the NSS database in /etc/pki/nssdb if it is already available in order to avoid a potentially confusing error message. https://pagure.io/freeipa/issue/8934 Signed-off-by: Rob Crittenden Reviewed-By: Florence Blanc-Renaud --- ipaserver/advise/plugins/smart_card_auth.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ipaserver/advise/plugins/smart_card_auth.py b/ipaserver/advise/plugins/smart_card_auth.py index a067f366c..4a3a96c1b 100644 --- a/ipaserver/advise/plugins/smart_card_auth.py +++ b/ipaserver/advise/plugins/smart_card_auth.py @@ -306,8 +306,9 @@ class config_client_for_smart_card_auth(common_smart_card_auth_config): shared_lib = self.pkcs11_shared_lib self.log.commands_on_predicate( - 'modutil -dbdir {} -list | grep -q {}'.format( - nssdb, module_name), + 'modutil -dbdir {nssdb} -list | grep -q {module_name} || ' + 'p11-kit list-modules | grep -i {module_name} -q'.format( + nssdb=nssdb, module_name=module_name), [ 'echo "{} PKCS#11 module already configured"'.format( module_name)