Explicitly logging out the token to avoid leaving it in a non-stable state.

base_policy/policy-utils.js

 // Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * Check the validity of the policy extension manifest.
  *
  * This function is invoked by entd before the policy is loaded in order to
  * check the validity of the extension manifest.  If this function returns
  * false, entd exits and does not restart until the next user logs in.
@@ skipping 476 matching lines @@
     }
     return true;
   }
 
   try {
     session = this.loginToken(token, userType, oldPin);
     if (!session)
       this.stop(token, 'error', 'Failed to login to token');
   } catch (ex) {
     this.stop(token, 'error', 'Exception initializing PIN: ' + ex);
-    session.close();
+    session.logoutAndClose();
     return false;
   }
 
   this.info('PIN Reset for: ' + pinType);
 
   try {
     session.setPin(oldPin, newPin);
     this.info('PIN Reset complete.');
   } catch (ex) {
     this.stop(token, 'error', 'Exception changing PIN: ' + ex);
-    session.close();
+    session.logoutAndClose();
     return false;
   }
 
   if (this.checkToken(token)) {
     this.stop(token, 'ready');
   } else {
     this.stop(token, pinType);
   }
 
-  session.close();
+  session.logoutAndClose();
   return true;
 }
 
 /**
  * Generate a RSA key pair on the PKCS#11 token.
  *
  * 'label' and 'id' parameters are user-friendly values that will be applied
  * to the generated keys.  They can be used later for documentation and/or
  * key search/match.
  *
@@ skipping 277 matching lines @@
         pin = Policy.PKCS11_SO_PIN;
         break;
       default:
         this.error('Unknown user type');
         return null;
     }
   }
 
   var session = null;
 
+  this.info('Opening session and logging into token.');
+
   try {
     token.closeAllSessions();
     session = token.openSession(Token.CKF_RW_SESSION);
   } catch (ex) {
     this.error('Unable to open session: ' + ex);
     return null;
   }
 
   try {
     if (!session.login(sessionType, pin)) {
       this.error('Unable to log in user into token.');
-      session.close();
+      session.logoutAndClose();
       return null;
     }
   } catch (ex) {
     this.error('Failed to login user into token: ' + ex);
-    session.close();
+    session.logoutAndClose();
     return null;
   }
 
   return session;
 }
 
 /**
  * Determine if this certificate definition has been successfully installed.
  *
  * @return {boolean} A boolean indicating whether or not this certificate
@@ skipping 102 matching lines @@
 
   var session = null;
   try {
     session = this.policy.loginToken(token, Session.CKU_USER);
     if (!session)
       return this.error('Cannot login to token.');
 
     var cert = policy.findCertificateById(session, this.id);
     var key = policy.findPrivateKeyById(session, this.id);
 
-    session.close();
+    session.logoutAndClose();
 
     return (cert != null && key != null);
   } catch(ex) {
-    session.close();
+    session.logoutAndClose();
     this.error('Error checking certificate is installed: ', ex);
   }
 
   return false;
 };
 
 /**
  * Initiate the CSR process for this certificate definition.
  */
 Policy.Certificate.prototype.initiateCSR =
@@ skipping 25 matching lines @@
   if (!session)
     return this.stop('error', 'Cannot login to token.');
 
   // Remove any existing entries matching this.id.
   this.policy.removeObjectsById(session, this.id);
 
   try {
     // Generate a key pair.
     this.policy.generateKeyPair(session, this.id, this.label);
   } catch(e) {
-    session.close();
+    session.logoutAndClose();
     return this.stop('error', 'Failed to create key on PKCS#11 device: ' + e);
   }
 
   this.stop('key', 'Key generation complete');
 
-  session.close();
+  session.logoutAndClose();
 
   this.start('csr', 'Initiating Certificate Signing Request');
 
   // create a CSR using the generated key pair.
   var engine = this.policy.engine;
   this.info('Generating CSR for id: ' + this.id + ' subject: ' + subject);
   var csr = engine.createCSR(this.id, subject);
 
   // Copy the CSR as a string to the environment.
   this.setVariable('csr', csr.toFormat(CSR.CSR_FORMAT_PEM_TEXT));
@@ skipping 128 matching lines @@
 
   // Convert response to DER.
   var x509 = new entd.crypto.OpenSSL.X509(cert, X509.X509_FORMAT_PEM_TEXT);
   var x509_der = x509.toFormat(X509.X509_FORMAT_DER);
 
   // Store certificate in the PKCS#11 token.
   this.storeCertificate(session, this.id, this.label, this.subject, x509_der);
 
   this.stop('cert');
 
-  session.close();
+  session.logoutAndClose();
 };
 
 Policy.prototype.setBrowserPolicy =
 function setBrowserPolicy(type, sourcePolicy) {
   var targetPolicy;
   if (type == "managed") {
     targetPolicy = entd.browser.managedPolicy;
   } else if (type == "recommended") {
     targetPolicy = entd.browser.recommendedPolicy;
   } else {
@@ skipping 800 matching lines @@
   var result = [];
   for (i = 0; i < str.length; i++) {
     var d = str.charCodeAt(i);
     var h = d.toString(16);
     if (h.length == 1)
       result.push('0');
     result.push(h);
   }
   return result.join('');
 }