SSSD не видит РуТокен ЭЦП 3.0 NFC, но видит РуТокен ЭЦП 2.0
Настроил сетевую аутентификацию через sssd.
записал на РуТокен ЭЦП 3.0 NFC - sssd не увидел сертификата.
записал на РуТокен ЭЦП 2.0 - sssd увидел сертификат.
Подскажите, пожалуйста, почему так происходит?
Моя конфигурация:
sssd.conf
---
[sssd]
domains = test.blue.white.red
config_file_version = 2
services = nss, pam, ifp
debug_level=10
[domain/test.blue.white.red]
ad_gpo_map_interactive = +fly-dm
ad_update_samba_machine_account_password = True
krb5_renew_interval = 600s
krb5_renewable_lifetime = 7d
krb5_ccname_template = FILE:%d/krb5cc_%U
ad_gpo_access_control = disabled
ad_domain = test.blue.white.red
krb5_realm = TEST.BLUE.WHITE.RED
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = False
krb5_auth_timeout = 120
ignore_group_members = True
debug_level=10
[ifp]
allowed_uids = 0, 33, 114, 106
debug_level=10
[pam]
#pam_pwd_expiration_warning = 7
pam_cert_auth = True
p11_child_timeout = 240
pam_cert_db_path = /etc/ssl/certs/ca-certificates.crt
p11_uri = PKCS11:model=Rutoken%20ECP%20NFC;serial=424a928f
pam_p11_allowed_services = +cinnamon-screensaver, +mate-screensaver, +lightdm
debug_level=10
#[certmap/test.blue.white.red/nt_principal]
#maprule = (|(userPrincipalName={subject_nt_principal})(samAccountName={subject_nt_principal.short_name}))
---
krb5.conf
---
# File modified by /bin/astra-ad-sssd-client
[libdefaults]
default_realm = TEST.BLUE.WHITE.RED
canonicalize = true
pkinit_anchors = FILE:/etc/ssl/certs/ca-certificates.crt
default_ccache_name = FILE:/tmp/krb5cc_%{uid}
pkinit_eku_checking = none
pkinit_kdc_hostname = dc.test.blue.white.red
#pkinit_identities = PKCS11:librtpkcs11ecp.so
#pkinit_identities = /usr/lib/librtpkcs11ecp.so
default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 RC4-HMAC DES-CBC-CRC DES3-CBC-SHA1 DES-CBC-MD5
default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 RC4-HMAC DES-CBC-CRC DES3-CBC-SHA1 DES-CBC-MD5
preferred_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 RC4-HMAC DES-CBC-CRC DES3-CBC-SHA1 DES-CBC-MD5
[realms]
TEST.BLUE.WHITE.RED = {
kdc = test.blue.white.red
admin_server = test.blue.white.red
default_domain = test.blue.white.red
}
[domain_realm]
test.blue.white.red = TEST.BLUE.WHITE.RED
.test.blue.white.red = TEST.BLUE.WHITE.RED
---