On fedora 33 using the latest freeipa, freeipa's opendnssec interface generates thousands of errors along the lines below when asked to enabled dnssec for a domain:

Dec 04 20:04:32 freeipa.redacted.com named-pkcs11[1434]: File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/97deddfc-a053-a54e-f06f-6934c081d1e8/d9bcc53d-ef2a-4636-ecb3-ada28eaf5418.object

The error arises because the file is created by softhsm2 with 0600 permissions and ods as the owner. As a result, named can't read the file even though the set-gid bit is set on the tokens directory and the owner of the tokens directory set to named.

The fix I found, and that I suggest be added to the ipa-dns-installer, in addition to the setgid bit on the tokens directory and setting the group of the tokens directory to named is:

setfacl -R -m d:g:named:rw /var/lib/ipa/dnssec/tokens

Or perhaps leaving the ownership of the tokens directory unchanged and instead

usermod -a -G ods named
and a modification to the setfacl

The alternative to all that is aking upstream patch to softhsm2 that creates new files in the tokens directory with 0660 instead of 0600.

HTH
Harry Coin