Thanks for the reply, Robert! We're using OpenSC 0.16.0 and it's working well so far. The problem turned out to be exactly what you suggested.
The JSS PK11Token login method takes a password callback handler. The handler has a getPasswordAgain method that's used for retries, and returning anything but null will result in a locked card. The handler should look something like this: PasswordCallback pwcb = new PasswordCallback() { @Override public Password getPasswordFirstAttempt(PasswordCallbackInfo info) throws GiveUpException { return new Password(pin.toCharArray()); } @Override public Password getPasswordAgain(PasswordCallbackInfo info) throws GiveUpException { return null; } }; -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto