My system is to the point where command line interaction with the smart card behaves as
expected, as long as I use the OpenSC middleware to pam_pkcs11, and not coolkey. Using
pklogin_finder asks for the PIN, verifies the certificates, and maps the user to a local
system account. System details in previous thread:
https://www.redhat.com/archives/pki-users/2015-April/msg00041.html
My expectation was that the "smart card manager" should pop up when the card is
inserted. It doesn't. I can type "esc" at the command line, and it says
"No Cards Present" with everything greyed out. Likewise, inserting the smart
card at the login prompt does nothing. There _is_ an "./escd" process running.
Is ESC hardwired to use coolkey, which can't read my card? How can I debug this?
Final question: Am I correct to assume that my situation does not call for a TPS, TKS, or
even a CA? I must not touch the info on these smart cards: Never format, never issue
certs, never save, never change. My machines just need to respect a totally external PKI
infrastructure: ask for PIN, verify cert against the CA bundle, and start a login session.
For any of the things I would need a PKI infrastructure for, I need to make an appointment
at a GSA Credentialing Center, then physically show up with two forms of ID in hand.
Many thanks for your helpful advice!
Bryce