Hello every one , I need help to rest the Pin for my token , and I have ( SO ) pin.

[Elsayed-Mubarak]

    let { soPin, newPin } = req.body
    /**
     * @desc — USING FIRST SLOT
     *
     */
    mode = mod
    var slot = mode.getSlots(0)
    /**
     *
     * @desc — PREPARE SESSION TO OPEN && ADD PERMISSION RW_SESSION
     */

    if (slot.flags & graphene.SlotFlag.TOKEN_PRESENT) {
      session = slot.open(
        graphene.SessionFlag.RW_SESSION | graphene.SessionFlag.SERIAL_SESSION,
      )
      console.log(' err ........................')
    }
    /**
     *
     * @desc — OPEN SESSION WITH TOKEN USING PIN AND USER TYPE `USER`
     */

    console.log(' type of ...........', typeof soPin)
    console.log(' type of ...........', typeof newPin)

    session.login(soPin, graphene.UserType.SO)

    session.setPin(soPin, newPin)
   // session.getObject()
    console.log(' session.getObject() ..........', session.getObject())

    // session.logout()

    session.close()

    mode.finalize()

    return res.status(200).json({ message: 'pin is changed ...' })

[microshine]

@Elsayed-Mubarak See C_SetPIN PKCS#11 documentation

C_SetPIN: Modifies the PIN of the user who is logged in

I tried your code using SoftHSM library. Instead of graphene.UserType.SO you need to use graphene.UserType.USER, cause you need to change the user password.

Here is my code which I tried

const slot = mod.getSlots(0)
if (slot.flags & graphene.SlotFlag.TOKEN_PRESENT) {
    const session = slot.open(
        graphene.SessionFlag.RW_SESSION | graphene.SessionFlag.SERIAL_SESSION,
    )
    session.login(oldPin, graphene.UserType.USER)
    session.setPin(oldPin, newPin);
    session.close();
}

[Elsayed-Mubarak]

@microshine , No I don't need to change my token pin , I already did it ,
But Now I need to make unblock to my token .. because my token is blocked when I tried to insert incorrect pin for 8 times , and now I have (So pin) for my token ??

[microshine]

I'm not sure it's possible by PKCS#11 interface

[rmhrisk]

Unblock is not possible via standard P11 interfaces. Each token implements its own scheme usually and is more smartcard than HSM concept so P11 never got APIs for it. It is possible to do by shoving APDUs into the card if you know the scheme used by the card.