Cannot read eID Carddate when user logins in on his PC using a AZURE Domein account (again)

[SGE66]

Hi,

I refer to #100

We have this issue if Windows Hello is used connecting to an Azure account ('local' logon with PIN code is no problem).

We can pinpoint the problem to following code (code used from sdk40 (example data.c file):

retVal = (pFunctions->C_GetSlotList) (CK_TRUE, 0, &slot_count);

Appareantly (card) reader cannot be accessed, no 'slots' are found.

Anyone experiencing the same problem and any idea to solve this ?

Tested with latest middleware version 5.0.17 (but alo 4.4.4 gave same error).

`
CK_ULONG beidsdk_GetData()
{
void *pkcs11Handle; //handle to the pkcs11 library
CK_FUNCTION_LIST_PTR pFunctions; //list of the pkcs11 function pointers
CK_C_GetFunctionList pC_GetFunctionList;
CK_RV retVal = CKR_OK;
DWORD err;

//Open the pkcs11 library
pkcs11Handle = dlopen(PKCS11_LIB, RTLD_LAZY); // RTLD_NOW is slower
if (pkcs11Handle != NULL) 
{
	// Get function pointer to C_GetFunctionList
	pC_GetFunctionList = (CK_C_GetFunctionList)dlsym(pkcs11Handle, "C_GetFunctionList");
	if (pC_GetFunctionList != NULL) 
	{
		// Invoke C_GetFunctionList to get the list of pkcs11 function pointers
		retVal = (*pC_GetFunctionList) (&pFunctions);
		if (retVal == CKR_OK) 
		{
			// initialize Cryptoki
			retVal = (pFunctions->C_Initialize) (NULL);
			if (retVal == CKR_OK)
			{		
				CK_ULONG slot_count = 0;
				// retrieve the number of slots (cardreaders) found
					//set first parameter to CK_FALSE if you also want to find the slots without a card inserted
					retVal = (pFunctions->C_GetSlotList) (CK_TRUE, 0, &slot_count);
					if ((retVal == CKR_OK) && (slot_count > 0) )
					{
						CK_SLOT_ID_PTR slotIds = (CK_SLOT_ID_PTR)malloc(slot_count * sizeof(CK_SLOT_INFO));
						if(slotIds != NULL)
					{

...`

[Frederikus]

Hello,

Could you provide me with a pkcs#11 log?

how to create one can be found here
https://eid.belgium.be/en/technical-documentation#7480

Thank you

[pieterjanvanneste]

Hi Frederikus, could you please send me your mailing address? In the log, there's a lot of private information :-D

[Frederikus]

Hello Pieterjan, Can you create a ticket at the service desk (please mention AZURE)? https://eid.belgium.be/en/contact You may tell them that we agreed to escalate the ticket directly to the developers, I'll inform them as well. Then we can continue there. Thank you, Frederik

…

On Fri, Sep 30, 2022 at 11:04 AM pieterjanvanneste ***@***.***> wrote: Hi Frederikus, could you please send me your mailing address? In the log, there's a lot of private information :-D — Reply to this email directly, view it on GitHub <#180 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA4FYJDUP5DTGGHI6RFFM3TWA2UJRANCNFSM6AAAAAAQR5S3GI> . You are receiving this because you commented.Message ID: ***@***.***>

[pieterjanvanneste]

Incident INC0663711

[pieterjanvanneste]

@Frederikus Can you give me an update on this?

Regards
Pieterjan

[Frederikus]

Hello PieterJan,

Thank you for the logs, it looks similar to the former issue.
Where the viewer gets a slot event and tries to handle it ,but in case of Hello For Business emulated card, during the handling errors are triggered which in turn seems to cause a new slot event.
And then the viewer gets looping.

Normally the pkcs#11 should skip trying to communicate with unknown cars (that's what fixed the issue before), so currently looking into why this case is different.

Wkr,
Frederik

[pieterjanvanneste]

Hi Frederik Is there any update on this issue? Regards Pieterjan Vanneste Team Lead IT Operations T: +32 11 71 12 80 E: ***@***.*** A: Corda Campus - Corda 6 Kempische Steenweg 293/35 3500 Hasselt <http://www.prato.be/> <https://www.facebook.com/PratoHR/> <https://twitter.com/pratohr> <https://www.linkedin.com/company/prato> Op do 13 okt. 2022 om 10:39 schreef Frederikus ***@***.***>:

…

Hello PieterJan, Thank you for the logs, it looks similar to the former issue. Where the viewer gets a slot event and tries to handle it ,but in case of Hello For Business emulated card, during the handling errors are triggered which in turn seems to cause a new slot event. And then the viewer gets looping. Normally the pkcs#11 should skip trying to communicate with unknown cars (that's what fixed the issue before), so currently looking into why this case is different. Wkr, Frederik — Reply to this email directly, view it on GitHub <#180 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFYZ2EML5MEDWXRCEJ6HEFTWC7DDBANCNFSM6AAAAAAQR5S3GI> . You are receiving this because you commented.Message ID: ***@***.***>

[Frederikus]

Hello PieterJan, We're working on it and try to have it fixed in the next middleware release. Wkr, Frederik

…

On Wed, Oct 19, 2022 at 9:03 AM pieterjanvanneste ***@***.***> wrote: Hi Frederik Is there any update on this issue? Regards Pieterjan Vanneste Team Lead IT Operations T: +32 11 71 12 80 E: ***@***.*** A: Corda Campus - Corda 6 Kempische Steenweg 293/35 3500 Hasselt <http://www.prato.be/> <https://www.facebook.com/PratoHR/> <https://twitter.com/pratohr> <https://www.linkedin.com/company/prato> Op do 13 okt. 2022 om 10:39 schreef Frederikus ***@***.***>: > Hello PieterJan, > > Thank you for the logs, it looks similar to the former issue. > Where the viewer gets a slot event and tries to handle it ,but in case of > Hello For Business emulated card, during the handling errors are triggered > which in turn seems to cause a new slot event. > And then the viewer gets looping. > > Normally the pkcs#11 should skip trying to communicate with unknown cars > (that's what fixed the issue before), so currently looking into why this > case is different. > > Wkr, > Frederik > > — > Reply to this email directly, view it on GitHub > <#180 (comment)>, or > unsubscribe > < https://github.com/notifications/unsubscribe-auth/AFYZ2EML5MEDWXRCEJ6HEFTWC7DDBANCNFSM6AAAAAAQR5S3GI > > . > You are receiving this because you commented.Message ID: > ***@***.***> > — Reply to this email directly, view it on GitHub <#180 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA4FYJCP3TRNBMNM4CYL2Z3WD6MMFANCNFSM6AAAAAAQR5S3GI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[pieterjanvanneste]

Hi Frederikus

Is there any update on this issue?
I think it is not fixed in the new release.

Regards

Pieterjan Vanneste
Team Lead IT Operations
T: +32 11 71 12 80
E: @.***

[Frederikus]

Hello Pieter-Jan, No new version has been released yet. (5.1.8 dates from August 2022 https://eid.belgium.be/sites/default/files/software/RN518mw.pdf). Wkr, Frederik

…

On Wed, Jan 18, 2023 at 12:27 PM pieterjanvanneste ***@***.***> wrote: Hi Frederikus Is there any update on this issue? I think it is not fixed in the new release. Regards Pieterjan Vanneste Team Lead IT Operations T: +32 11 71 12 80 E: *@*.*** — Reply to this email directly, view it on GitHub <#180 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA4FYJDFN2DUYCBXBRHBME3WS7HTBANCNFSM6AAAAAAQR5S3GI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[pieterjanvanneste]

Hi Frederikus

Is there any update on this issue?

Regards

Pieterjan Vanneste

[SachaPhilipsen]

Hi Frederikus

We're still awaiting feedback. Could you please provide us with the most recent status?

Kind regards

Sacha

[Frederikus]

Hello Sacha, In order to determine if the changes in the pkcs#11 for the eID Viewer fixes this issue, can you test with the pkcs#11 library that comes with the eID Viewer? After installing the eID Viewer (separate install from the middleware), you can find this one at e.g. C:\Program Files (x86)\Belgium Identity Card\EidViewer Wkr, Frederik

…

On Tue, Jan 16, 2024 at 3:39 PM SachaPhilipsen ***@***.***> wrote: Hi Frederikus We're still awaiting feedback. Could you please provide us with the most recent status? Kind regards Sacha — Reply to this email directly, view it on GitHub <#180 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA4FYJHYGQQWF35BFCYDMKLYO2GLLAVCNFSM6AAAAAAQR5S3GKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOJTHA4DCMZRHA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[SachaPhilipsen]

Hi Frederik The eID Viewer reads and displays my information correctly. Using the BeTrust plugin I receive the known error: "( ERROR: Cannot read Carddata: Open slot failed )" Kind regards Sacha Philipsen Team Lead IT Operations T: +32 11 71 12 80 E: ***@***.*** A: Corda Campus - Corda 6 Kempische Steenweg 293/35 3500 Hasselt <http://www.prato.be/> <https://www.facebook.com/PratoHR/> <https://twitter.com/pratohr> <https://www.linkedin.com/company/prato> Op do 18 jan 2024 om 08:32 schreef Frederikus ***@***.***>:

…

Hello Sacha, In order to determine if the changes in the pkcs#11 for the eID Viewer fixes this issue, can you test with the pkcs#11 library that comes with the eID Viewer? After installing the eID Viewer (separate install from the middleware), you can find this one at e.g. C:\Program Files (x86)\Belgium Identity Card\EidViewer Wkr, Frederik On Tue, Jan 16, 2024 at 3:39 PM SachaPhilipsen ***@***.***> wrote: > Hi Frederikus > > We're still awaiting feedback. Could you please provide us with the most > recent status? > > Kind regards > > Sacha > > — > Reply to this email directly, view it on GitHub > <#180 (comment)>, or > unsubscribe > < https://github.com/notifications/unsubscribe-auth/AA4FYJHYGQQWF35BFCYDMKLYO2GLLAVCNFSM6AAAAAAQR5S3GKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOJTHA4DCMZRHA> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> > — Reply to this email directly, view it on GitHub <#180 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BFMNZCGGELIBSFWOXMJJO5TYPDFY7AVCNFSM6AAAAAAQR5S3GKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOJXHE2DKNRSGY> . You are receiving this because you commented.Message ID: ***@***.***>

[Frederikus]

Hello Sacha, Thank you for your feedback. Just for my understanding, are you a user or a developer of the betrust plugin? In case you are a developer, could you try a build that uses the pkcs#11 library that is installed with the eID Viewer? Wkr, Frederik On Mon, Jan 22, 2024 at 2:49 PM SachaPhilipsen ***@***.***> wrote:

…

Hi Frederik The eID Viewer reads and displays my information correctly. Using the BeTrust plugin I receive the known error: "( ERROR: Cannot read Carddata: Open slot failed )" Kind regards Sacha Philipsen Team Lead IT Operations T: +32 11 71 12 80 E: ***@***.*** A: Corda Campus - Corda 6 Kempische Steenweg 293/35 3500 Hasselt <http://www.prato.be/> <https://www.facebook.com/PratoHR/> <https://twitter.com/pratohr> <https://www.linkedin.com/company/prato> Op do 18 jan 2024 om 08:32 schreef Frederikus ***@***.***>: > Hello Sacha, > > In order to determine if the changes in the pkcs#11 for the eID Viewer > fixes this issue, can you test with the pkcs#11 library that comes with > the > eID Viewer? > After installing the eID Viewer (separate install from the middleware), > you > can find this one at e.g. C:\Program Files (x86)\Belgium Identity > Card\EidViewer > > Wkr, > Frederik > > On Tue, Jan 16, 2024 at 3:39 PM SachaPhilipsen ***@***.***> > wrote: > > > Hi Frederikus > > > > We're still awaiting feedback. Could you please provide us with the most > > recent status? > > > > Kind regards > > > > Sacha > > > > — > > Reply to this email directly, view it on GitHub > > <#180 (comment)>, > or > > unsubscribe > > < > https://github.com/notifications/unsubscribe-auth/AA4FYJHYGQQWF35BFCYDMKLYO2GLLAVCNFSM6AAAAAAQR5S3GKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOJTHA4DCMZRHA> > > > . > > You are receiving this because you were mentioned.Message ID: > > ***@***.***> > > > > — > Reply to this email directly, view it on GitHub > <#180 (comment)>, or > unsubscribe > < https://github.com/notifications/unsubscribe-auth/BFMNZCGGELIBSFWOXMJJO5TYPDFY7AVCNFSM6AAAAAAQR5S3GKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOJXHE2DKNRSGY> > . > You are receiving this because you commented.Message ID: > ***@***.***> > — Reply to this email directly, view it on GitHub <#180 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA4FYJHQEHB7JQGDEWIPGRTYPZU7RAVCNFSM6AAAAAAQR5S3GKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMBUGA2DGOBWHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>