Chapter 5 Troubleshooting

This section explains how to solve Solaris Smartcard problems. The following sections are included:

• To Enable Debugging (Console)

• To Enable Debugging (Command Line)

• To Disable Smartcard

• To Disable Smartcard

• To Resolve Smart Card Login Problems

• To Resolve Configuration Problems

• To Resolve Applet Downloading Problems

• To Add a Missing ATR

You can debug smart card operations on a system by setting the debugging properties. Solaris Smartcard offers standard debugging and a detailed trace of your operations, if specified. If enabled, debugging information is logged to a file. You can control the level and amount of debugging information on 0–9 scale. Debugging is disabled by default.

The following debugging properties are defined for ocfserv by default:

debugging.filename        = /var/run/ocf.log
debugging                 = 0
OpenCard.trace            = com.sun:9 opencard.core:9

If you are running a previous Solaris 8 release, the debugging log file might be called /tmp/ocf_debugfile.

To Enable Debugging (Console)

Use the Debug folder if you want to set up the ocfserv debugging property. Setting up debugging is optional.

1. Select OCF Server from the Navigation pane.

2. Double-click the icon representing the local system.

3. Select the Debug folder.

4. Slide the indicator for the OCF Debug Level slider to the right to indicate the level of debugging you want on the OCF Server.

5. Slide the indicator for the Open Card Trace Level slider to the right to indicate the trace level you want on the OCF Server.

6. (Optional) Specify an alternate name for the debug file.

   1. Click Browse to view the file systems on the system.

   2. Type the fully qualified path name for the debug file in the OCF Debug File Location field.

7. Click Apply or OK.

To Enable Debugging (Command Line)

Use the following procedure to enable smart card debugging.

1. Become superuser.

2. Enable smart card debugging by setting debugging=1.

   # smartcard -c admin -x modify debugging=1

   In the following example, the location of the ocfserv debugging file is changed by specifying the -x modify debugging.filename option and a fully qualified file name for the debugging file.

   # smartcard -c admin -x modify debugging.filename=/var/tmp/sc.debug

To Disable Smartcard

You might need to disable Smartcard on a system if a Smartcard setup problem does not allow a user to log in with a smart card, or if a system no longer needs a smart card login.

1. Become superuser.

2. Disable smart card operations.

   # smartcard -c disable

To Resolve Smart Card Login Problems

After you have enabled Smartcard and logged off from a system, the CDE login screen displays the following prompt:

Please insert Smart Card

If you are unable to log into a system using a smart card because of Smartcard setup problems, try the following:

1. Log in to the system remotely with the rlogin or telnet command.

2. su to root.

3. Disable Smartcard:

   # smartcard -c disable

   After Smartcard is disabled, the CDE screen displays the following prompt:

   Enter User Name

4. Correct the Smartcard setup problem.

To Resolve Configuration Problems

The /etc/smartcard/opencard.properties file stores important smart card configuration information. This file requires no administration and should not be edited manually. However, if you inadvertently introduced a problem in your smart card configuration by using either the Smartcard Console or the command line, you can restore the previous version of the /etc/smartcard/opencard.properties file from the command line.

1. Become superuser.

2. Change to the /etc/smartcard directory.

3. Save the current version first.

   # cp opencard.properties opencard.properties.bad

4. Copy the previous version to the current version.

   # cp opencard.properties.bak opencard.properties

To Resolve Applet Downloading Problems

1. If you see the following message while trying to download the applet on the card, it is possible that you have not added the ATR of the smart card inserted in the reader to the list of valid ATRs the system can accept.

   SmartcardInvalidCardException

2. Try updating the card's ATR by following the procedure in To Add Support for a New Card Type (New ATR).

To Add a Missing ATR

When you try to add a smart card in the Smartcard Console, a screen displays the ATR of the card inserted in the reader. If the ATR displayed does not exist in the list of valid ATRs, add the ATR to the card-name.ATR property.

See To Add Support for a New Card Type (New ATR) for more information. See command-line example below.

Example—Adding a Missing ATR (Command Line)

Display ocfserv properties to see if the card_name.ATR property exists.

# smartcard -c admin

For example, ocfserv lists a property MySCM.0.ATR, where MySCM is the user-friendly name of the card reader. This property reflects the ATR of the smart card inserted in the reader. This property is temporary and is added by ocfserv only for the time the card is in the reader. This property is removed when the card is removed.

Add this ATR to the card_name.ATR property if the ATR displayed by this property does not exist in the list of valid ATRs.