I’m using OpenJDK 11 to authenticate via PKCS11 with a HSM server. The token info received from the server has the flag CKF_PROTECTED_AUTHENTICATION_PATH so the authentication can’t be done with a pin. How to implement the authentication in this case? I can’t find details about this scenario in the documentation.

The Java 11 PKCS11 reference describes only pin authentication:

String configName = "/opt/bar/cfg/pkcs11.cfg";
Provider p = Security.getProvider("SunPKCS11");
p = p.configure(configName);
Security.addProvider(p);
KeyStore ks = KeyStore.getInstance("PKCS11");
ks.load(null, pin);    //line 6

Line 6 causes a call to C_GetTokenInfo and if the token has this particular flag then sun.security.pkcs11.SunPKCS11#login calls C_Login with a null pin.

The PKCS11 v.2.11 standard describes this flag:

TRUE if token has a “protected authentication path”, whereby a user can log into the token without passing a PIN through the Cryptoki library.

But then how is the authentication performed?